Critical Security Update for Buildah: Addressing Container Escape and Denial of Service Vulnerabilities
Summary
ALSA-2025:22012: Important: buildah security update. Affects buildah versions < 2:1.41.6-1.el10_1. Fixed in 2:1.41.6-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or from existing images, and to build images using Dockerfiles. The package is essential for developers working with containerized applications, providing flexibility and efficiency in image creation. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing Buildah.
Vulnerability Detail
The vulnerabilities stem from issues in the runc component, which can lead to container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881). Additionally, a flaw in the Go programming language's archive/tar package allows for unbounded allocation when parsing GNU sparse maps (CVE-2025-58183). These vulnerabilities can potentially allow attackers to manipulate container behavior or exhaust system resources, leading to significant security risks.
How To Fix
Minimum fixed version
2:1.41.6-1.el10_1
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the permissions of containers and restrict access to sensitive resources until the package is updated. This can be done by configuring container security policies to minimize exposure.
Conclusion
In summary, the recent vulnerabilities in Buildah pose significant security risks that can lead to container escape and denial of service. It is essential for users to update their packages to the latest patched versions to ensure the security of their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for buildah →
FAQ
Buildah is a tool for building OCI container images, allowing users to create and manage container images efficiently.
The vulnerabilities include container escape and denial of service due to issues in runc and unbounded allocation in the Go archive/tar package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing stricter container security policies as a temporary workaround.
For detailed information, refer to the CVE pages for CVE-2025-52881 and CVE-2025-58183.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
