CVE-2025-4953: Podman Creates Temporary File with Insecure Permissions

The vulnerability, CVE-2025-4953, arises from Podman's handling of bind mounts during the build process, which can lead to files being created on the host with insecure permissions. The root cause lies within the Buildah library, a dependency of Podman responsible for building container images.

My analysis began by identifying the patched version of Podman, v5.5.1, and comparing it to the last known vulnerable version, v5.5.0. This comparison revealed that the primary change was a version bump of the Buildah dependency from v1.40.0 to v1.40.1.

By examining the changes within the Buildah library between these two versions, I pinpointed the exact code modifications that address the vulnerability. The changes are concentrated in run_linux.go and are related to the handling of SELinux relabeling options (z and Z) for bind mounts.

The vulnerable functions, Builder.Run and its helper Builder.runSetupVolumeMounts, were modified to explicitly handle these SELinux options within Buildah itself, rather than passing them down to the OCI runtime. The patch adds logic to perform the relabeling and then strips the options from the mount configuration. This prevents the OCI runtime from misinterpreting the options and creating files with incorrect, insecure permissions in the host's temporary build directory.

Therefore, any runtime profile of a vulnerable Podman version executing a build with a RUN --mount=type=bind instruction would show these functions in the call stack. The presence of these functions, combined with the specific build operation, is a strong indicator of exploitation of this vulnerability.