← Voltar para CVEs

CVE-2024-9675

HIGH

7.8

Descricao

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Detalhes CVE

Pontuacao CVSS v3.17.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado10/9/2024

Ultima modificacao8/25/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

buildah_project:buildahredhat:enterprise_linuxredhat:enterprise_linux_eusredhat:enterprise_linux_for_arm_64redhat:enterprise_linux_for_arm_64_eusredhat:enterprise_linux_for_ibm_z_systemsredhat:enterprise_linux_for_ibm_z_systems_eusredhat:enterprise_linux_for_power_little_endianredhat:enterprise_linux_for_power_little_endian_eusredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat:enterprise_linux_server_tusredhat:enterprise_linux_update_services_for_sap_solutionsredhat:openshift_container_platform

Fraquezas (CWE)

CWE-22CWE-22

Referencias

https://access.redhat.com/errata/RHSA-2024:8563(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8675(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8679(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8686(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8690(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8700(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8703(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8707(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8708(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8709(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8846(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8984(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:8994(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:9051(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:9454(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:9459(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:2445(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:2449(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:2454(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:2701(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:2710(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:3301(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:3573(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2024-9675(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2317458(secalert@redhat.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.