CVE-2024-11218 HIGH

CVE-2024-11218: Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Weakness CWE-269
Published January 22, 2025
Last update April 29, 2026

CVSS base score

8.6/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

Key dates

02Disclosure timeline

January 22, 2025 CVE published
April 29, 2026 Record updated