CVE-2024-11218

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

HIGH 8.6

At a glance

Source: NVD
EPSS: EPSS 0.36 % · percentile 30 (2026-10-28)
State: PUBLISHED
Published: 2025-01-22 04:55 UTC
Updated: 2026-10-13 02:20 UTC
Assigner: redhat
NVD status: Deferred

Description

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

Weaknesses (CWE)

CWE-269 — Improper Privilege Management

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	redhat
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	NVD · secalert@redhat.com (Secondary)

Advisories

GHSA-5vpc-35f4-r8w6 — Buildah allows build breakout using malicious Containerfiles and concurrent builds
GO-2025-3414 — Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah

European references

ENISA EUVD · EUVD-2025-0135
GCVE · GCVE-0-2024-11218

CERT-FR advisories

CERTFR-2025-AVI-0401 — Multiples vulnérabilités dans Juniper Networks Secure Analytics · cert.ssi.gouv.fr
CERTFR-2025-AVI-0370 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected products

Product	Versions
buildah	affected 0 < 1.33.12 ; affected 1.35.0 < 1.35.5 ; affected 1.37.0 < 1.37.6 ; affected 1.38.0 < 1.38.1
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250124120243.afee755d < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020250203202123.3b538bd8 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected 8060020250203202123.3b538bd8 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected 8060020250203202123.3b538bd8 < *
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update Support	unaffected 8080020250207173112.0f77c1b7 < *
Red Hat · Red Hat Enterprise Linux 9	unaffected 4:5.2.2-13.el9_5 < *
Red Hat · Red Hat Enterprise Linux 9	unaffected 2:1.37.6-1.el9_5 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	unaffected 2:4.2.0-6.el9_0 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	unaffected 1:1.26.9-1.el9_0 < *
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support	unaffected 1:1.29.5-1.el9_2 < *
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support	unaffected 2:4.4.1-22.el9_2 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected 2:1.33.12-2.el9_4 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected 4:4.9.4-17.el9_4 < *
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 412.86.202503052321-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.12	unaffected 3:4.2.0-13.rhaos4.12.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 1:1.29.5-1.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 3:4.4.1-16.rhaos4.13.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13	unaffected 413.92.202503112237-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.14	unaffected 3:4.4.1-22.rhaos4.14.el8 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD