CVE-2025-4953

Executive Summary

CVE-2025-4953 is a security advisory concerning Podman, a daemonless container engine. The vulnerability arises during the podman build process when using RUN --mount=type=bind mounts in a Containerfile or Podmanfile. Data written to these bind mounts during the build is not properly discarded after the build completes. This can lead to files created inside the container appearing in the temporary build context directory on the host, potentially exposing sensitive data to unauthorized users on the host system. The vulnerability has a CVSS score of 0.0, indicating incomplete scoring data, but the underlying issue poses a risk of information disclosure.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): UNKNOWN
• Attack Complexity (AC): UNKNOWN
• Privileges Required (PR): UNKNOWN
• User Interaction (UI): UNKNOWN
• Scope (S): UNKNOWN
• Confidentiality (C): UNKNOWN
• Integrity (I): UNKNOWN
• Availability (A): UNKNOWN

Threat Level: Medium (based on the nature of the vulnerability – information disclosure via build artifacts)

Deep Dive & Mechanics

The vulnerability is rooted in how Podman handles RUN --mount=type=bind mounts during image builds. When a Containerfile includes a command like:

RUN --mount=type=bind,source=/tmp/host_data,target=/container_data cp /container_data/secrets.txt /tmp/

During the build, the bind mount makes the host directory /tmp/host_data available inside the container at /container_data. If the build process writes data to this mount point (e.g., copying files from the container to the mount), those files are written directly to the host filesystem. After the build completes, Podman is supposed to clean up the temporary build context, but due to this flaw, files written to bind mounts persist on the host.

Attack Scenario:

1. An attacker crafts a malicious Containerfile that uses RUN --mount=type=bind to write sensitive data (e.g., SSH keys, credentials) to a host directory.
2. The victim (developer or CI/CD system) builds this Containerfile using podman build.
3. During the build, the attacker's payload writes data to the bind mount, which is reflected on the host.
4. After the build, the files remain on the host, accessible to any user with read permissions on the build context directory.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): In the vulnerable version, Podman does not track files written to bind mounts during the build and does not clean them up after the build completes.

# Pseudocode for vulnerable behavior
def build_image(containerfile):
    context_dir = create_temp_context()
    for instruction in parse(containerfile):
        if instruction.type == "RUN" and instruction.mount.type == "bind":
            mount_host_dir(instruction.mount.source, instruction.mount.target)
            execute_instruction(instruction)
            # No cleanup of files written to mount
    # Build completes, context_dir may contain leaked files

Patched Code (Expected): A patch would ensure that any files written to bind mounts during the build are either discarded or that the mount is made read-only by default.

# Pseudocode for patched behavior
def build_image(containerfile):
    context_dir = create_temp_context()
    for instruction in parse(containerfile):
        if instruction.type == "RUN" and instruction.mount.type == "bind":
            # Option 1: Make mount read-only
            mount_host_dir(instruction.mount.source, instruction.mount.target, read_only=True)
            execute_instruction(instruction)
            # Option 2: Track and clean up files
            track_files_written(instruction.mount.target)
    cleanup_temp_context(context_dir)  # Includes cleaning tracked files

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install Podman (vulnerable version).
2. Create a malicious Containerfile:

FROM alpine:latest
RUN --mount=type=bind,source=/tmp/leak,target=/leak echo "SENSITIVE_DATA" > /leak/stolen.txt

3. Create the host directory and build:

mkdir /tmp/leak
podman build -t malicious -f Containerfile .

4. After build, check for leaked file:

cat /tmp/leak/stolen.txt

Expected Output: SENSITIVE_DATA is present on the host.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected files appearing in build context directories.
• Use auditd to track writes to /tmp or other build directories during podman build processes.

Prevention:

• Avoid using RUN --mount=type=bind with write access in Containerfiles from untrusted sources.
• Use --mount=type=bind,readonly=true to prevent writes.
• Run builds in isolated environments (e.g., VMs, dedicated CI runners).

Indicators of Compromise (IOCs)

• File Artifacts: Unexpected files in /tmp/ or other build context directories after a podman build operation.
• Process Anomalies: podman build processes that write to host directories outside the container.
• Network IOCs: None directly, but exfiltration of leaked files may be observed.

Detection Engineering

YARA Rule

rule CVE_2025_4953_Podman_Bind_Mount_Leak {
    meta:
        description = "Detects files created by Podman build bind mount leaks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4953"
    strings:
        $s1 = "RUN --mount=type=bind" nocase
        $s2 = "podman build" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Podman Build Bind Mount File Leak
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential file leaks from Podman build bind mounts
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/podman'
        TargetFilename|startswith: '/tmp/'
        EventID: 11  # File creation
    condition: selection
falsepositives:
    - Legitimate use of bind mounts with write access
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-4953 Podman Build Bind Mount Leak - Potential Exfiltration"; flow:to_server,established; content:"podman build"; nocase; content:"RUN --mount=type=bind"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Avoid untrusted Containerfiles: Do not build Containerfiles from untrusted sources that use RUN --mount=type=bind.
2. Use read-only mounts: Modify any RUN --mount=type=bind to include readonly=true:

RUN --mount=type=bind,source=/tmp/data,target=/data,readonly=true cp /data/file /tmp/

3. Isolate build environments: Run podman build in isolated environments (e.g., VMs, containers with limited host filesystem access).

Long-term Fix:

• Apply patches from Podman maintainers when available.
• Monitor for updates at Podman GitHub.

Workaround:

• Use podman build --no-cache and manually clean build context directories after each build.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert