A vulnerability in Podman container build processes creates a risk of sensitive file exposure on the host system due to insecure handling of temporary bind mounts.

This vulnerability (CWE-378) occurs because data written to RUN --mount=type=bind mounts during a Podman build is not properly discarded. The flaw allows files created within the container build context to persist in the temporary directory on the host, where they may be accessed by other users or processes. The attack is unauthenticated, as it pertains to the build environment process.

The potential for unauthorized access to files created during the container build process presents a significant risk to data confidentiality and integrity. If sensitive configuration files, credentials, or proprietary source code are written to these temporary directories, an attacker with local access to the host could compromise sensitive project data. With a CVSS score of 7.4, this high-severity flaw necessitates prompt attention to prevent accidental data leakage within multi-tenant or shared build environments.

Immediate Action: Update your Red Hat Enterprise Linux and OpenShift Container Platform environments to the versions specified in the vendor errata (RHSA-2024:8690 and subsequent updates) to ensure the build process correctly purges temporary mount data.

Proactive Monitoring: Review host system logs and monitor for unauthorized access to temporary directories frequently used by container build processes.

Compensating Controls: Restrict access to the build environment host and ensure that container build processes are run with the least privilege necessary to minimize the impact of potential file exposure.

Public Exploit Available: Unknown

This vulnerability represents a high risk to environment security, particularly in shared build infrastructures where multiple users may access the same host. Administrators should prioritize the application of the provided Red Hat security updates immediately to ensure that container build artifacts are handled securely and do not persist on the host filesystem.