CVE-2024-11218

EUVD-2025-0135
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
redhatCNA
8.6 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 37%
Debian logo
Debian Releases
Debian Product
Codename
golang-github-containers-buildah
bookworm
no-dsa
bullseye
no-dsa
forky
1.42.1+ds1-2
fixed
sid
1.42.1+ds1-2
fixed
trixie
1.39.3+ds1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
podman
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
needs-triage
questing
needs-triage
References