CVE-2024-9341: Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-01 · updated 2026-10-30
Weakness: CWE-59

Description

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

Affected products

containers Common: all versions
Red Hat Enterprise Linux: 8.0, 9.0 (and their updates)
Red Hat OpenShift Container Platform 4.18: 4.12, 4.13, 4.14, 4.15, 4.16, 4.17 (and their updates)
github.com/containers/common: before 0.60.4 — fixed in 0.60.4
Red Hat OpenShift Container Platform 4.18: all versions — fixed in 2:1.33.7-4.rhaos4.18.el9
Red Hat Enterprise Linux 8: all versions — fixed in 8100020241023085649.afee755d
Red Hat Enterprise Linux 9: all versions — fixed in 4:4.9.4-13.el9_4
Red Hat OpenShift Container Platform 4.12: all versions — fixed in 0:1.25.5-30.rhaos4.12.git53dc492.el8
Red Hat OpenShift Container Platform 4.13: all versions — fixed in 0:1.26.5-26.rhaos4.13.giteb3d487.el8
Red Hat OpenShift Container Platform 4.14: all versions — fixed in 0:1.27.8-10.rhaos4.14.git807f92c.el8
Red Hat OpenShift Container Platform 4.15: all versions — fixed in 0:1.28.11-5.rhaos4.15.git35a2431.el8
Red Hat OpenShift Container Platform 4.16: all versions — fixed in 0:1.29.9-5.rhaos4.16.git34690b9.el8
Red Hat OpenShift Container Platform 4.17: all versions — fixed in 0:1.30.6-3.rhaos4.17.git49b5172.el8

How to fix

Upgrade to a fixed version: github.com/containers/common 0.60.4; Red Hat OpenShift Container Platform 4.18 2:1.33.7-4.rhaos4.18.el9; Red Hat Enterprise Linux 8 8100020241023085649.afee755d; Red Hat Enterprise Linux 9 4:4.9.4-13.el9_4; Red Hat OpenShift Container Platform 4.12 0:1.25.5-30.rhaos4.12.git53dc492.el8; Red Hat OpenShift Container Platform 4.13 0:1.26.5-26.rhaos4.13.giteb3d487.el8; Red Hat OpenShift Container Platform 4.14 0:1.27.8-10.rhaos4.14.git807f92c.el8; Red Hat OpenShift Container Platform 4.15 0:1.28.11-5.rhaos4.15.git35a2431.el8; Red Hat OpenShift Container Platform 4.16 0:1.29.9-5.rhaos4.16.git34690b9.el8; Red Hat OpenShift Container Platform 4.17 0:1.30.6-3.rhaos4.17.git49b5172.el8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-9341 or the next vulnerability affects your stack