Medium severity · published Oct 9, 2024
CVE-2024-9675
Buildah: buildah allows arbitrary directory mount
4.4
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
OpenShift Developer Tools and Services · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.6 Telecommunications Update Service · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.8 Extended Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9.0 Extended Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9.2 Extended Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4.12 · Red Hat
All versions, or not specified · source: vendor
Affected product
OD
OpenShift Developer Tools and Services
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9675
access.redhat.com
https://access.redhat.com/errata/RHBA-2024:10967
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:8563
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:8675
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:8679
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:8686
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:8690
More from OpenShift Developer Tools and Services
9.8
CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function
9.1
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
8.8
CVE-2025-67030
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642
8.3
CVE-2024-3727
Containers/image: digest type does not guarantee valid type
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509