Vulnerability · Published Oct 15, 2024 · Assigned by redhat

CVE-2024-9676Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

Medium 6.5

In plain English

A medium-severity path traversal in containers/storage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.3%top 28.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	buildah	2:1.33.11-1.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	buildah	2:1.37.5-1.el9_5	ALSA-2024:9459
AlmaLinux:8	buildah-tests	2:1.33.11-1.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	buildah-tests	2:1.37.5-1.el9_5	ALSA-2024:9459
AlmaLinux:8	cockpit-podman	84.1-1.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	container-selinux	2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	containernetworking-plugins	1:1.4.0-5.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:10289
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3792+03eaed9c	ALSA-2024:10289
AlmaLinux:8	podman	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	podman	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:9	podman	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:8	podman-catatonit	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	podman-docker	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	podman-docker	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:9	podman-docker	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:8	podman-gvproxy	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	podman-plugins	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	podman-plugins	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:9	podman-plugins	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:8	podman-remote	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	podman-remote	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:9	podman-remote	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:8	podman-tests	4:4.9.4-18.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:9	podman-tests	4:4.9.4-16.el9_4	ALSA-2024:9051
AlmaLinux:9	podman-tests	4:5.2.2-9.el9_5	ALSA-2024:9454
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	python3-podman	4.9.0-3.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	runc	1:1.1.12-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	skopeo	2:1.14.5-3.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	skopeo-tests	2:1.14.5-3.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	skopeo-tests	2:1.14.5-3.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3901+4b80ecd7	ALSA-2024:10289
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3876+e55593a8	ALSA-2024:10289
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3845+87b84552	ALSA-2024:10289
AlmaLinux:8	toolbox	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2024:10289
AlmaLinux:8	toolbox-tests	0.0.99.5-2.module_el8.10.0+3858+6ad51f9f	ALSA-2024:10289
AlmaLinux:8	udica	0.2.6-21.module_el8.10.0+3926+f12484f5	ALSA-2024:10289
Alpine:v3.20	buildah	1.37.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.21	buildah	1.37.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.22	buildah	1.37.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.23	buildah	1.37.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.24	buildah	1.37.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.20	podman	5.2.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.21	podman	5.2.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.22	podman	5.2.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.23	podman	5.2.5-r0	ALPINE-CVE-2024-9676
Alpine:v3.24	podman	5.2.5-r0	ALPINE-CVE-2024-9676
Debian:12	golang-github-containers-storage	no fix listed	DEBIAN-CVE-2024-9676
Debian:13	golang-github-containers-storage	1.55.1+ds1-1	DEBIAN-CVE-2024-9676
Debian:14	golang-github-containers-storage	1.55.1+ds1-1	DEBIAN-CVE-2024-9676
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889	RLSA-2024:10289
Rocky Linux:8	buildah	2:1.33.11-1.module+el8.10.0+1896+b18fa106	RLSA-2024:10289
Rocky Linux:8	cockpit-podman	0:84.1-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1843+6892ab28	RLSA-2024:10289
Rocky Linux:8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28	RLSA-2024:10289
Rocky Linux:8	criu	0:3.18-5.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	crun	0:1.14.3-2.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	libslirp	0:4.4.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	podman	4:4.9.4-18.module+el8.10.0+1896+b18fa106	RLSA-2024:10289
Rocky Linux:9	podman	4:4.9.4-16.el9_4	RLSA-2024:9051
Rocky Linux:8	python-podman	0:4.9.0-3.module+el8.10.0+1896+b18fa106	RLSA-2024:10289
Rocky Linux:8	runc	1:1.1.12-5.module+el8.10.0+1874+ce489889	RLSA-2024:10289
Rocky Linux:8	skopeo	2:1.14.5-3.module+el8.10.0+1843+6892ab28	RLSA-2024:10289
Rocky Linux:8	slirp4netns	0:1.2.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Rocky Linux:8	toolbox	0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2	RLSA-2024:10289
Rocky Linux:8	udica	0:0.2.6-21.module+el8.10.0+1815+5fe7415e	RLSA-2024:10289
Ubuntu:22.04:LTS	golang-github-containers-buildah	no fix listed	UBUNTU-CVE-2024-9676
Ubuntu:24.04:LTS	golang-github-containers-storage	no fix listed	UBUNTU-CVE-2024-9676

Affected products (as reported)

Vendor	Product	Versions
	containers/storage	0 – before 1.55.1
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

RHEA-2024:6126 vendor-advisory, x_refsource_REDHAT
RHSA-2024:10289 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8418 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8428 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8437 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8686 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8690 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8694 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8700 vendor-advisory, x_refsource_REDHAT
RHSA-2024:8984 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9051 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9454 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9459 vendor-advisory, x_refsource_REDHAT
RHSA-2024:9926 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0876 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2454 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2710 vendor-advisory, x_refsource_REDHAT
RHSA-2025:3301 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-9676 vdb-entry, x_refsource_REDHAT
RHBZ#2317467 issue-tracking, x_refsource_REDHAT
https://github.com/advisories/GHSA-wq2p-5pc6-wpgf
https://github.com/containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679