CVE-2024-9676: Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-15 · updated 2026-11-01
Weakness: CWE-22

Description

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

Affected products

Red Hat Enterprise Linux: 9.0 (and their updates)
RedHat Enterprise Linux Eus: 9.4 (and their updates)
RedHat Enterprise Linux For Arm 64: 9.0_aarch64 (and their updates)
RedHat Enterprise Linux For Arm 64 Eus: 9.4_aarch64 (and their updates)
RedHat Enterprise Linux For Ibm Z Systems: 9.0_s390x (and their updates)
RedHat Enterprise Linux For Ibm Z Systems Eus: 9.4_s390x (and their updates)
RedHat Enterprise Linux For Power Little Endian: 9.0_ppc64le (and their updates)
RedHat Enterprise Linux For Power Little Endian Eus: 9.4_ppc64le (and their updates)
RedHat Enterprise Linux Server Aus: 9.4 (and their updates)
RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 9.4_ppc64le (and their updates)
Red Hat OpenShift Container Platform 4.18: 4.12, 4.13, 4.14, 4.15, 4.16, 4.17 (and their updates)
RedHat Openshift Container Platform For Arm64: 4.12, 4.13, 4.14, 4.15, 4.16 (and their updates)
RedHat Openshift Container Platform For Ibm Z: 4.12, 4.13, 4.14, 4.15, 4.16 (and their updates)
RedHat Openshift Container Platform For Linuxone: 4.12, 4.13, 4.14, 4.15, 4.16 (and their updates)
RedHat Openshift Container Platform For Power: 4.12, 4.13, 4.14, 4.15, 4.16 (and their updates)
containers/storage: before 1.55.1 — fixed in 1.55.1
Red Hat OpenShift Container Platform 4.18: all versions — fixed in 2:1.33.7-4.rhaos4.18.el9
Red Hat OpenShift Developer Tools and Services: all versions
Red Hat Quay 3: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 8100020241101101019.afee755d
Red Hat Enterprise Linux 9: all versions — fixed in 4:4.9.4-16.el9_4
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 2:1.33.11-1.el9_4
Red Hat OpenShift Container Platform 4.12: all versions — fixed in 0:1.25.5-30.rhaos4.12.git53dc492.el8
Red Hat OpenShift Container Platform 4.13: all versions — fixed in 0:1.26.5-26.rhaos4.13.giteb3d487.el8
Red Hat OpenShift Container Platform 4.14: all versions — fixed in 0:1.27.8-12.rhaos4.14.git7597c43.el8
Red Hat OpenShift Container Platform 4.15: all versions — fixed in 0:1.28.11-5.rhaos4.15.git35a2431.el8
Red Hat OpenShift Container Platform 4.16: all versions — fixed in 0:1.29.9-6.rhaos4.16.gite7bd45a.el8
Red Hat OpenShift Container Platform 4.17: all versions — fixed in 0:1.30.6-6.rhaos4.17.git6ac6e96.el8

How to fix

Upgrade to a fixed version: containers/storage 1.55.1; Red Hat OpenShift Container Platform 4.18 2:1.33.7-4.rhaos4.18.el9; Red Hat Enterprise Linux 8 8100020241101101019.afee755d; Red Hat Enterprise Linux 9 4:4.9.4-16.el9_4; Red Hat Enterprise Linux 9.4 Extended Update Support 2:1.33.11-1.el9_4; Red Hat OpenShift Container Platform 4.12 0:1.25.5-30.rhaos4.12.git53dc492.el8; Red Hat OpenShift Container Platform 4.13 0:1.26.5-26.rhaos4.13.giteb3d487.el8; Red Hat OpenShift Container Platform 4.14 0:1.27.8-12.rhaos4.14.git7597c43.el8; Red Hat OpenShift Container Platform 4.15 0:1.28.11-5.rhaos4.15.git35a2431.el8; Red Hat OpenShift Container Platform 4.16 0:1.29.9-6.rhaos4.16.gite7bd45a.el8; Red Hat OpenShift Container Platform 4.17 0:1.30.6-6.rhaos4.17.git6ac6e96.el8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-9676 or the next vulnerability affects your stack