CVE-2024-9675: Buildah Arbitrary Directory Mount Vulnerability
Summary
CVE-2024-9675: Buildah allows arbitrary directory mount in github.com/containers/buildah. Affects github.com/containers/buildah versions < 1.37.1. Fixed in 1.37.1. How to fix ↓
Also tracked for
- golang-github-containers-buildah · Debian:11
The same CVE-2024-9675 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is an open-source tool designed for building OCI and Docker container images. It allows users to create and manage container images without requiring a full container runtime. Buildah is widely used in containerized environments for its flexibility and efficiency in image creation. However, it has been found to have a vulnerability that allows arbitrary directory mounts, which could lead to unauthorized access to sensitive files or directories within the host system.
Vulnerability Detail
The vulnerability identified as CVE-2024-9675 in Buildah allows for arbitrary directory mounts. This issue arises from insufficient validation of user input when specifying mount points. An attacker could exploit this vulnerability to mount any directory from the host system into the container, potentially exposing sensitive data or allowing for further attacks on the host. The ramifications of this vulnerability are significant, as it compromises the isolation that containers are supposed to provide, leading to potential data breaches or system compromises.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.37.1
This is the first release that contains the fix.
go get github.com/containers/buildah@v1.37.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of Buildah to trusted users only and limit the permissions of the directories that can be mounted. Additionally, consider using container security tools that can enforce policies on what can be mounted into containers.
Conclusion
The CVE-2024-9675 vulnerability in Buildah poses a significant risk by allowing arbitrary directory mounts, which can compromise the security of the host system. Users are encouraged to update to the latest version of Buildah to mitigate this risk and to implement workarounds if immediate updates cannot be performed.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
CVE-2024-9675 is a vulnerability in Buildah that allows for arbitrary directory mounts, potentially exposing sensitive data from the host system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files on the host system, which can lead to data breaches or further exploitation of the system.
Yes, users are advised to update to the latest version of Buildah that addresses this vulnerability.
If an immediate update is not possible, implement strict access controls and consider using security tools to limit the impact of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
