podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

DEBIAN-CVE-2024-11218

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

CVE-2024-11218

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

AZL-55953 CVE-2024-11218 affecting package podman for versions less than 5.6.1-2

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

AZL-55959 CVE-2024-11218 affecting package buildah for versions less than 1.41.4-2

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...

Buildah 安全漏洞

Buildah is a Buildah open source tool that supports building OCI container images. A security vulnerability exists in Buildah that stems from building a malicious Containerfile using --jobs=2 and a contention condition, leading to container escape and host file enumeration...

PT-2025-1315

Name of the Vulnerable Software and Affected Versions podman versions prior to 5.3.2 buildah versions prior to 1.38.1 Description A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious...

PT-2025-36328

Name of the Vulnerable Software and Affected Versions podman versions 4.0.0 through 5.6.1 Description A vulnerability exists in podman where an attacker can use the kube play command to overwrite host files. This occurs when the kube file contains a Secret or a ConfigMap volume mount, and that...

GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5

Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host.

...

Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...

The vulnerability of the network management system for monitoring industrial networks in Siemens SINEC NMS lies in the improper assignment of permissions to critical resources. This allows a perpetrator to write arbitrary data to any location in the host’s file system.

The vulnerability of the Siemens SINEC NMS network management system for monitoring industrial networks is related to the improper assignment of permissions for critical resources. The application contains a database that does not restrict user rights. Exploiting this vulnerability allows a hacke...

Astra Linux – Vulnerability in libpod

BuildKit is a toolkit for converting source code into build artifacts in an efficient, expressive, and repeatable manner. Two malicious build steps running in parallel, which share the same cache mounts for subpaths, could cause a race condition that allows files from the host system to be...

Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...

Arbitrary File Creation

github.com/nvidia/nvidia-container-toolkit is vulnerable to arbitrary file creation. The vulnerability is due to the default mode of operation, which allows a specially crafted container image to interact with the host file system and create empty files...

Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...

SUSE CVE-2024-0134

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this...

Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...

AZL-52393 CVE-2024-0134 affecting package nvidia-container-toolkit for versions less than 1.17.1-1

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this...