CVE-2024-9407

Publication date 1 October 2024

Last updated 30 May 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

4.7 · Medium

Score breakdown

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

Status

Package Ubuntu Release Status
golang-github-containers-buildah 25.04 plucky
Not affected
24.10 oracular
Needs evaluation
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal Not in release

Severity score breakdown

Parameter Value
Base score 4.7 · Medium
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N