CVE-2024-9407

mediumpriority · track · 0EPSS 0.003 · 21 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.29% (21st) EPSS

CVSS 4.7 · medium

Is it mine?

25 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgovulncheck-vulndb-0.0.20241030T212825-150000.1.9.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgovulncheck-vulndb-0.0.20241104T154416-5.1.noarch as component of SUSE Package Hub 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.7mediumAV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · ENISA EU

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · secalert@redhat.com USexploitability 0.5 · impact 4.2

v3.14.7mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:Nsecondary · OSV

v3.14.3mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.3mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:Nsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20US

affected products (25)

Products and version ranges known to be affected.

Red Hat Red Hat Enterprise Linux 8< 8100020241023085649.afee755denisa_euvdEU
Red Hat Red Hat Enterprise Linux 9< 2:1.37.5-1.el9_5enisa_euvdEU
Red Hat Red Hat Enterprise Linux 9< 4:4.9.4-16.el9_4enisa_euvdEU
Red Hat Red Hat Enterprise Linux 9< 4:5.2.2-9.el9_5enisa_euvdEU
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support< 2:1.33.11-1.el9_4enisa_euvdEU
Red Hat Red Hat OpenShift Container Platform 4.16< 416.94.202411201433-0enisa_euvdEU
Red Hat Inc. Podman≤ 5.2.4fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat Inc. Red Hat OpenShift Container Platform≤ 4fstec_bduRU
АО «ИВК» АЛЬТ СП 10all versionsfstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 3.1fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
Go github.com/containers/buildah< 1.37.4osvUSpkg:golang/github.com/containers/buildah
Go github.com/containers/podmanall versionsosvUSpkg:golang/github.com/containers/podman
Go github.com/containers/podman< 5.2.4osvUSpkg:golang/github.com/containers/podman
Go github.com/containers/podman/v2all versionsosvUSpkg:golang/github.com/containers/podman/v2
Go github.com/containers/podman/v2< 5.2.4osvUSpkg:golang/github.com/containers/podman/v2

showing 20 of 25

advisories (4)

Vendor and ecosystem advisories describing this.

SUSE-SU-2024:3911-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
openSUSE-SU-2024:0350-1Security update for govulncheck-vulndb2024-11-05csaf · suse_csafDE
Security update for govulncheck-vulndb
GHSA-fhqq-8f65-5xfcImproper Input Validation in Buildah and Podman2024-10-01ghsa · osvUS
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
GO-2024-3169Improper Input Validation in Buildah and Podman in github.com/containers/buildah2024-10-09vendor · osvUS
Improper Input Validation in Buildah and Podman in github.com/containers/buildah

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv suse_csaf NVD CVE.org MITRE

published 2024-10-01modified 2026-10-22

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan