NIXPKGS-2025-0022

published on 29 Oct 2025

Permalink CVE-2024-11218

updated 3 months ago by @Erethon Activity log

Created automatic suggestion 1 year ago
@fricklerhandwerk accepted 1 year ago
@Erethon published on GitHub 3 months ago

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

Affected products

rhcos

podman

buildah

<1.35.5
*
<1.38.1
<1.33.12
<1.37.6

container-tools:rhel8

container-tools:rhel8/podman

container-tools:rhel8/buildah

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

nixos-unstable 5.3.1
- nixpkgs-unstable 5.3.1
- nixos-unstable-small 5.3.1

pkgs.buildah

Tool which facilitates building OCI images

nixos-unstable 1.38.0
- nixpkgs-unstable 1.38.0
- nixos-unstable-small 1.38.0

pkgs.podman-tui

Podman Terminal UI

nixos-unstable 1.3.0
- nixpkgs-unstable 1.3.0
- nixos-unstable-small 1.3.0

Package maintainers

@saschagrunert Sascha Grunert <mail@saschagrunert.de>
@vdemeester Vincent Demeester <vincent@sbr.pm>
@aaronjheng Aaron Jheng <wentworth@outlook.com>