CVE-2024-11218
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
- Affected products
- Almalinux, Astra Linux, Centos, Debian, Red Hat, Red Os, Rocky Linux, Suse
- Fix
- Available
- CVSS 3.1
- 8.6 HIGH
- EPSS
- 0.4% (28th percentile)
- Weakness
- CWE-269
- NVD status
- Deferred
- Published
- 2025-01-22
Workaround
Mandatory access controls should limit the access of the process performing the build, on systems where they are enabled. SELinux enforces strict access controls by confining the build process (e.g., Podman) to specific domains like container_t. This prevents unauthorized access to sensitive host files and directories, even if a malicious Containerfile tries to exploit the --mount flag.
No indexed exploits for CVE-2024-11218 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-11218 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.