CVE-2024-11218 Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting Podman and Buildah Identified Two vulnerabilities affecting Podman and Buildah have been reported. CVE-2024-9407 involves improper input validation in the bind-propagation option of Dockerfile run, while CVE-2024-11218 allows for container breakout through a race condition when building a malicious containerfile. Both vulnerabilities could impact users of these container management tools. 2 sources 41