CVE-2024-9407 in Red Hat
Summary
by MITRE • 10/02/2024
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/09/2025
The vulnerability identified as CVE-2024-9407 represents a critical security flaw in Docker's build system that specifically targets the bind-propagation option within the RUN --mount instruction of Dockerfiles. This weakness arises from insufficient input validation mechanisms that govern how the mount instruction processes user-provided parameters. The flaw allows attackers to manipulate the mount operation by passing arbitrary parameters that can override default security boundaries, effectively breaking down the isolation between host and container environments during the build phase. The vulnerability manifests when Docker fails to properly sanitize or validate the inputs provided to the --mount option, creating an opportunity for privilege escalation and unauthorized access to host resources.
The technical implementation of this vulnerability stems from a lack of proper parameter validation within Docker's build process execution engine. When users specify the bind-propagation option, the system should enforce strict boundaries on acceptable mount source paths and propagation modes. However, the current implementation allows malicious inputs to bypass these validation checks, enabling attackers to specify host directories that should remain inaccessible to containerized processes. This flaw directly relates to CWE-20, which addresses improper input validation, and CWE-250, which deals with execution with unnecessary privileges. The vulnerability can be exploited by constructing a Dockerfile that includes a RUN --mount command with carefully crafted parameters that reference sensitive host directories such as /etc, /root, or other system-critical locations.
The operational impact of CVE-2024-9407 extends beyond simple information disclosure, as it can enable attackers to modify the contents of mounted files during the build process. This capability allows for persistent modifications to host system files, potentially leading to complete system compromise. Even when SELinux is properly configured and active, this vulnerability can bypass mandatory access controls by leveraging the ability to relabel source directories during mount operations. The attack vector becomes particularly dangerous when combined with other exploitation techniques, as it can be used to create backdoors, modify system binaries, or establish persistent access points. The vulnerability affects Docker versions where the build system does not properly enforce mount source path restrictions, making it a widespread concern across various deployment scenarios.
Organizations should implement immediate mitigations to address this vulnerability by updating their Docker installations to versions that include proper input validation for the mount instruction. System administrators should also establish strict policies around Dockerfile construction, particularly regarding the use of --mount options with bind propagation. The recommended approach involves implementing automated code scanning tools that can detect potentially dangerous mount configurations in Dockerfiles before they are executed. Additionally, organizations should consider implementing container build isolation measures that prevent the use of host directories in build processes unless absolutely necessary. From an ATT&CK perspective, this vulnerability maps to T1548.003 (Abuse Elevation Control Mechanism) and T1059.001 (Command and Scripting Interpreter), as it enables attackers to escalate privileges and execute commands with elevated access. The vulnerability also aligns with T1496 (Resource Hijacking) by allowing unauthorized access to host resources during the build process, potentially leading to resource consumption and system performance degradation.