podman build and buildah: race with --jobs during a malicious Containerfile build breaks out to the host

Impact

A Containerfile crafted by whoever supplies the build context can win a race during a parallel build (--jobs=2) and escape the build container. Red Hat describes it as a container breakout; with SELinux enforcing the impact is reduced but still allows enumeration of files and directories on the host. On a GPU fleet the build hosts are usually the machines that assemble CUDA and inference images, and they commonly hold registry push credentials and cluster kubeconfigs - so anything that reads or writes host paths from inside a build is a credential-exposure problem, not just a sandbox bug. Any pipeline that builds images from untrusted or user-contributed Dockerfiles is the realistic path in.

Who can reach it

Anyone who can get a Containerfile built by podman build or buildah on the host - CI jobs, tenant-submitted image builds, or a user with shell access on a build node. No prior privilege on the host is needed beyond having the build run; the CVSS vector records local access with user interaction.

What to do

Update podman and buildah from your distribution; Red Hat shipped the fix in the RHSA errata listed in the record for RHEL 8 and 9 and their extended-support streams. This is a package update on build hosts - no node drain or reboot, and running containers are unaffected; re-run builds with the updated binaries. Until patched, keep SELinux enforcing (it limits the breakout to host filesystem enumeration) and avoid --jobs on builds from untrusted input.

References

Related entries

• runc: "Leaky Vessels": internal file descriptor leak lets a container process start with cwd in the host filesystemCVE-2024-21626 · runcHigh
• Envoy proxy (ext_authz filter): When Envoy's ext_authz filter is configured with failure_mode_allow set to trueCVE-2024-23324 · Envoy proxy (ext_authz filter)High
• Harbor (harbor-helm, default core.secretName JWT signing key): SUPPLY CHAIN, UNAUTHENTICATED REGISTRY ACCESS: HarborNCVD-2023-011-harbor-harbor-helm-default-core · Harbor (harbor-helm, default core.secretName JWT signing key)High
• Helm: The `lookup` template function discloses in-cluster resources, including Secrets, to a chart authorCVE-2020-11013 · HelmHigh
• runc: Container filesystem breakout via directory traversal in mount handlingCVE-2021-30465 · runcHigh
• Argo CD: Authorization bypass lets an Application be synced to a destination it is not permitted to reachCVE-2023-22736 · Argo CDHigh