Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-11218— Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

CVSS 8.6 · High EPSS 0.36% · P30

Affected Version Matrix 42

VendorProductVersion RangeStatus
NoneNone< 1.33.12affected
1.35.0< 1.35.5affected
1.37.0< 1.37.6affected
1.38.0< 1.38.1affected
Red HatRed Hat Enterprise Linux 10anyunaffected
anyaffected
Red HatRed Hat Enterprise Linux 88100020250124120243.afee755d< *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support8060020250203202123.3b538bd8< *unaffected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service8060020250203202123.3b538bd8< *unaffected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions8060020250203202123.3b538bd8< *unaffected
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support8080020250207173112.0f77c1b7< *unaffected
Red HatRed Hat Enterprise Linux 94:5.2.2-13.el9_5< *unaffected
2:1.37.6-1.el9_5< *unaffected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions2:4.2.0-6.el9_0< *unaffected
1:1.26.9-1.el9_0< *unaffected
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support1:1.29.5-1.el9_2< *unaffected
2:4.4.1-22.el9_2< *unaffected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support2:1.33.12-2.el9_4< *unaffected
4:4.9.4-17.el9_4< *unaffected
Red HatRed Hat OpenShift Container Platform 4.12412.86.202503052321-0< *unaffected
3:4.2.0-13.rhaos4.12.el9< *unaffected
Red HatRed Hat OpenShift Container Platform 4.131:1.29.5-1.rhaos4.13.el8< *unaffected
3:4.4.1-16.rhaos4.13.el8< *unaffected
413.92.202503112237-0< *unaffected
Red HatRed Hat OpenShift Container Platform 4.143:4.4.1-22.rhaos4.14.el8< *unaffected
1:1.29.5-1.rhaos4.14.el8< *unaffected
414.92.202503100617-0< *unaffected
1:1.29.5-1.rhaos4.14.el8< *unaffected
Red HatRed Hat OpenShift Container Platform 4.153:4.4.1-33.rhaos4.15.el8< *unaffected
1:1.29.5-1.rhaos4.15.el8< *unaffected
415.92.202503060749-0< *unaffected
1:1.29.5-1.rhaos4.15.el8< *unaffected
Red HatRed Hat OpenShift Container Platform 4.164:4.9.4-13.rhaos4.16.el8< *unaffected
2:1.33.12-1.rhaos4.16.el8< *unaffected
416.94.202502180249-0< *unaffected
2:1.33.12-1.rhaos4.16.el8< *unaffected
Red HatRed Hat OpenShift Container Platform 4.175:5.2.2-2.rhaos4.17.el8< *unaffected
2:1.33.12-1.rhaos4.17.el8< *unaffected
2:1.33.12-1.rhaos4.17.el8< *unaffected
417.94.202504080421-0< *unaffected
Red HatRed Hat OpenShift Container Platform 4.182:1.33.12-1.rhaos4.18.el9< *unaffected
418.94.202504021150-0< *unaffected

I. Basic Information for CVE-2024-11218

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Buildah 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Buildah是Buildah开源的一款支持构建OCI容器映像的工具。 Buildah存在安全漏洞，该漏洞源于使用 --jobs=2 和竞争条件构建恶意 Containerfile，导致容器逃逸和主机文件枚举。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-- 0 ~ 1.33.12 -
Red HatRed Hat Enterprise Linux 8 8100020250124120243.afee755d ~ * cpe:/a:redhat:enterprise_linux:8::appstream
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250203202123.3b538bd8 ~ * cpe:/a:redhat:rhel_aus:8.6::appstream
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250203202123.3b538bd8 ~ * cpe:/a:redhat:rhel_aus:8.6::appstream
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250203202123.3b538bd8 ~ * cpe:/a:redhat:rhel_aus:8.6::appstream
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support 8080020250207173112.0f77c1b7 ~ * cpe:/a:redhat:rhel_eus:8.8::appstream
Red HatRed Hat Enterprise Linux 9 4:5.2.2-13.el9_5 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red HatRed Hat Enterprise Linux 9 2:1.37.6-1.el9_5 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions 2:4.2.0-6.el9_0 ~ * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions 1:1.26.9-1.el9_0 ~ * cpe:/a:redhat:rhel_e4s:9.0::appstream
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support 1:1.29.5-1.el9_2 ~ * cpe:/a:redhat:rhel_eus:9.2::appstream
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support 2:4.4.1-22.el9_2 ~ * cpe:/a:redhat:rhel_eus:9.2::appstream
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support 2:1.33.12-2.el9_4 ~ * cpe:/a:redhat:rhel_eus:9.4::appstream
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support 4:4.9.4-17.el9_4 ~ * cpe:/a:redhat:rhel_eus:9.4::appstream
Red HatRed Hat OpenShift Container Platform 4.12 412.86.202503052321-0 ~ * cpe:/a:redhat:openshift:4.12::el8
Red HatRed Hat OpenShift Container Platform 4.12 3:4.2.0-13.rhaos4.12.el9 ~ * cpe:/a:redhat:openshift:4.12::el8
Red HatRed Hat OpenShift Container Platform 4.13 1:1.29.5-1.rhaos4.13.el8 ~ * cpe:/a:redhat:openshift:4.13::el8
Red HatRed Hat OpenShift Container Platform 4.13 3:4.4.1-16.rhaos4.13.el8 ~ * cpe:/a:redhat:openshift:4.13::el8
Red HatRed Hat OpenShift Container Platform 4.13 413.92.202503112237-0 ~ * cpe:/a:redhat:openshift:4.13::el8
Red HatRed Hat OpenShift Container Platform 4.14 3:4.4.1-22.rhaos4.14.el8 ~ * cpe:/a:redhat:openshift:4.14::el8
Red HatRed Hat OpenShift Container Platform 4.14 1:1.29.5-1.rhaos4.14.el8 ~ * cpe:/a:redhat:openshift:4.14::el8
Red HatRed Hat OpenShift Container Platform 4.14 414.92.202503100617-0 ~ * cpe:/a:redhat:openshift:4.14::el8
Red HatRed Hat OpenShift Container Platform 4.14 1:1.29.5-1.rhaos4.14.el8 ~ * cpe:/a:redhat:openshift:4.14::el8
Red HatRed Hat OpenShift Container Platform 4.15 3:4.4.1-33.rhaos4.15.el8 ~ * cpe:/a:redhat:openshift:4.15::el8
Red HatRed Hat OpenShift Container Platform 4.15 1:1.29.5-1.rhaos4.15.el8 ~ * cpe:/a:redhat:openshift:4.15::el8
Red HatRed Hat OpenShift Container Platform 4.15 415.92.202503060749-0 ~ * cpe:/a:redhat:openshift:4.15::el8
Red HatRed Hat OpenShift Container Platform 4.15 1:1.29.5-1.rhaos4.15.el8 ~ * cpe:/a:redhat:openshift:4.15::el8
Red HatRed Hat OpenShift Container Platform 4.16 4:4.9.4-13.rhaos4.16.el8 ~ * cpe:/a:redhat:openshift:4.16::el8
Red HatRed Hat OpenShift Container Platform 4.16 2:1.33.12-1.rhaos4.16.el8 ~ * cpe:/a:redhat:openshift:4.16::el8
Red HatRed Hat OpenShift Container Platform 4.16 416.94.202502180249-0 ~ * cpe:/a:redhat:openshift:4.16::el9
Red HatRed Hat OpenShift Container Platform 4.16 2:1.33.12-1.rhaos4.16.el8 ~ * cpe:/a:redhat:openshift:4.16::el8
Red HatRed Hat OpenShift Container Platform 4.17 5:5.2.2-2.rhaos4.17.el8 ~ * cpe:/a:redhat:openshift:4.17::el8
Red HatRed Hat OpenShift Container Platform 4.17 2:1.33.12-1.rhaos4.17.el8 ~ * cpe:/a:redhat:openshift:4.17::el8
Red HatRed Hat OpenShift Container Platform 4.17 2:1.33.12-1.rhaos4.17.el8 ~ * cpe:/a:redhat:openshift:4.17::el8
Red HatRed Hat OpenShift Container Platform 4.17 417.94.202504080421-0 ~ * cpe:/a:redhat:openshift:4.17::el9
Red HatRed Hat OpenShift Container Platform 4.18 2:1.33.12-1.rhaos4.18.el9 ~ * cpe:/a:redhat:openshift:4.18::el8
Red HatRed Hat OpenShift Container Platform 4.18 418.94.202504021150-0 ~ * cpe:/a:redhat:openshift:4.18::el9
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10

II. Public POCs for CVE-2024-11218

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8311 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2024-11218

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-11218 (1)

Vendor Advisories for CVE-2024-11218 (31)

IV. Related Vulnerabilities

Same weakness: CWE-269

V. Comments for CVE-2024-11218

No comments yet

Leave a comment