CVE-2024-11218

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-11218
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-11218.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-11218
Aliases
Downstream
AZL (4)
BELL (1)
CGA (6)
DEBIAN (1)
OESA (1)
openSUSE (2)
RHSA (22)
RLSA (3)
SUSE (9)
UBUNTU (1)
Related
ALSA (3)
openSUSE (2)
SUSE (9)
Published
2025-01-22T04:55:30Z
Modified
2026-10-16T02:54:09Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
Details

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11218.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "8100020250124120243.afee755d"
                        },
                        {
                            "fixed": "8060020250203202123.3b538bd8"
                        },
                        {
                            "fixed": "8060020250203202123.3b538bd8"
                        },
                        {
                            "fixed": "8060020250203202123.3b538bd8"
                        },
                        {
                            "fixed": "8080020250207173112.0f77c1b7"
                        },
                        {
                            "fixed": "4:5.2.2-13.el9_5"
                        },
                        {
                            "fixed": "2:1.37.6-1.el9_5"
                        },
                        {
                            "fixed": "2:4.2.0-6.el9_0"
                        },
                        {
                            "fixed": "1:1.26.9-1.el9_0"
                        },
                        {
                            "fixed": "1:1.29.5-1.el9_2"
                        },
                        {
                            "fixed": "2:4.4.1-22.el9_2"
                        },
                        {
                            "fixed": "2:1.33.12-2.el9_4"
                        },
                        {
                            "fixed": "4:4.9.4-17.el9_4"
                        },
                        {
                            "fixed": "412.86.202503052321-0"
                        },
                        {
                            "fixed": "3:4.2.0-13.rhaos4.12.el9"
                        },
                        {
                            "fixed": "1:1.29.5-1.rhaos4.13.el8"
                        },
                        {
                            "fixed": "3:4.4.1-16.rhaos4.13.el8"
                        },
                        {
                            "fixed": "413.92.202503112237-0"
                        },
                        {
                            "fixed": "3:4.4.1-22.rhaos4.14.el8"
                        },
                        {
                            "fixed": "1:1.29.5-1.rhaos4.14.el8"
                        },
                        {
                            "fixed": "414.92.202503100617-0"
                        },
                        {
                            "fixed": "1:1.29.5-1.rhaos4.14.el8"
                        },
                        {
                            "fixed": "3:4.4.1-33.rhaos4.15.el8"
                        },
                        {
                            "fixed": "1:1.29.5-1.rhaos4.15.el8"
                        },
                        {
                            "fixed": "415.92.202503060749-0"
                        },
                        {
                            "fixed": "1:1.29.5-1.rhaos4.15.el8"
                        },
                        {
                            "fixed": "4:4.9.4-13.rhaos4.16.el8"
                        },
                        {
                            "fixed": "2:1.33.12-1.rhaos4.16.el8"
                        },
                        {
                            "fixed": "416.94.202502180249-0"
                        },
                        {
                            "fixed": "2:1.33.12-1.rhaos4.16.el8"
                        },
                        {
                            "fixed": "5:5.2.2-2.rhaos4.17.el8"
                        },
                        {
                            "fixed": "2:1.33.12-1.rhaos4.17.el8"
                        },
                        {
                            "fixed": "2:1.33.12-1.rhaos4.17.el8"
                        },
                        {
                            "fixed": "417.94.202504080421-0"
                        },
                        {
                            "fixed": "2:1.33.12-1.rhaos4.18.el9"
                        },
                        {
                            "fixed": "418.94.202504021150-0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/podman-container-tools/buildah

Affected ranges

Type
GIT
Repo
https://github.com/podman-container-tools/buildah
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
58af1cdf16e3cdcdf2e885b570c1fa5d04857c3a
Introduced
fedbd79676e8aa5dc49d9434f6d9361b5e00ba62
Fixed
df0b92073ee9d34c1f86e03b4ffb17ec25e514e4
Introduced
f9de1bbd1f80288f541fe59cfffc5849469408e1
Fixed
fd39521492e60607ce8b2867bd44182e15059858
Introduced
7aa3b5ee0470647fcf125930913132fe7c556bcd
Fixed
a07dde1b8d12cd35717aae96ecda38cb6911e9c3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.33.12"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.35.0"
                },
                {
                    "fixed": "1.35.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.37.0"
                },
                {
                    "fixed": "1.37.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.38.0"
                },
                {
                    "fixed": "1.38.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

1.*
1.4
v0.*
v0.1
v0.10
v0.12
v0.15
v0.2
v0.3
v0.4
v0.5
v0.6
v0.7
v0.8
v1.*
v1.11.3
v1.11.4
v1.11.5
v1.13.2
v1.3
v1.35.0
v1.37.0
v1.37.4
v1.38.0
v1.4
v1.5
v1.6
v1.7
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.1
v1.8.2
v1.8.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-11218.json"