CVE-2024-9407
MEDIUM EPSS 20.4%
Published Oct 1, 20241y ago · Modified Jun 17, 20262w ago
4.7 CVSS 3.1
Published Oct 1, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N Attack Vector Local
Attack Complexity High
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
20.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-20 Improper Input Validation Validation
References 10
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:10147
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:8846
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:9051
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:9454
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:9459
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:9926
- access.redhat.com https://access.redhat.com/security/cve/CVE-2024-9407
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2315887
- github.com https://github.com/advisories/GHSA-fhqq-8f65-5xfc
- security.netapp.com https://security.netapp.com/advisory/ntap-20241220-0010/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.