Skip to main content

Improper Link Resolution Before File Access ('Link Following')

CVE-2024-1753

High
8.6/10

Summary

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time. This issue affects github.com/containers/buildah versions prior to 1.33.7, 1.34.x prior to 1.34.3, and 1.35.x prior to 1.35.1.

  • LOW
  • LOCAL
  • HIGH
  • CHANGED
  • REQUIRED
  • NONE
  • HIGH
  • HIGH

CWE-59 - Improper Link Resolution Before File Access

'Improper link resolution before file access' occurs when software accesses a file resource but fails to verify that the file isn't a link or shortcut to another file. An attacker can potentially gain access to arbitrary files and from there the impact can vary, depending on the application, from sensitive data exposure to remote code execution.

References

Advisory Timeline

  • Published