VYPR
← All advisories
High severity8.6GHSA Advisory· Published Mar 18, 2024· Updated Apr 15, 2026

CVE-2024-1753

CVE-2024-1753

Description

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/containers/podman/v4Go
< 4.9.44.9.4
github.com/containers/podman/v5Go
< 5.0.15.0.1

Affected products

154

Patches

Vulnerability mechanics

References

30

News mentions

0

No linked articles in our index yet.