Privilege Context Switching Error Affecting github.com/containers/buildah/internal/volumes package, versions <1.24.7 >=1.26.0 <1.26.7 >=1.27.0 <1.27.4 >=1.29.0 <1.29.3 >=1.30.0 <1.31.5 >=1.32.0 <1.32.3 >=1.33.0 <1.33.7 >=1.34.0 <1.34.2 >=1.35.0 <1.35.1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCONTAINERSBUILDAHINTERNALVOLUMES-6457430
- published 19 Mar 2024
- disclosed 18 Mar 2024
- credit Rory McNamara
How to fix?
Upgrade github.com/containers/buildah/internal/volumes to version 1.24.7, 1.26.7, 1.27.4, 1.29.3, 1.31.5, 1.32.3, 1.33.7, 1.34.2, 1.35.1 or higher.
Overview
Affected versions of this package are vulnerable to Privilege Context Switching Error due to a flaw in the handling of Containerfile configurations. Specifically, a malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source. This allows the mount operation to mount the host root filesystem inside the RUN step, granting the commands within RUN read-write access to the host filesystem. Consequently, this leads to unauthorized modifications or full control over the host system from within the container during the build process.
Workaround
This vulnerability can be mitigated by enabling SELinux, which restricts the container to limited read-only access.