CVE-2024-9676

MEDIUM

MEDIUM Priority: 0.09 BB Relevance: 63/100

Published: 2024-10-15 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network

AC: Low

PR: Low

UI: None

S: Unchanged

C: None

I: None

A: High

Description

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

Weakness Classification (1)

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Software (37)

Vendor	Product	Version
—	—	0 < 1.55.1
redhat	enterprise_linux	9.0
redhat	enterprise_linux_eus	9.4
redhat	enterprise_linux_for_arm_64	9.0_aarch64
redhat	enterprise_linux_for_arm_64_eus	9.4_aarch64
redhat	enterprise_linux_for_ibm_z_systems	9.0_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	9.4_s390x
redhat	enterprise_linux_for_power_little_endian	9.0_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	9.4_ppc64le
redhat	enterprise_linux_server_aus	9.4
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	9.4_ppc64le
redhat	openshift_container_platform	4.12
redhat	openshift_container_platform	4.13
redhat	openshift_container_platform	4.14
redhat	openshift_container_platform	4.15
redhat	openshift_container_platform	4.16
redhat	openshift_container_platform	4.17
redhat	openshift_container_platform_for_arm64	4.12
redhat	openshift_container_platform_for_arm64	4.13
redhat	openshift_container_platform_for_arm64	4.14
redhat	openshift_container_platform_for_arm64	4.15
redhat	openshift_container_platform_for_arm64	4.16
redhat	openshift_container_platform_for_ibm_z	4.12
redhat	openshift_container_platform_for_ibm_z	4.13
redhat	openshift_container_platform_for_ibm_z	4.14
redhat	openshift_container_platform_for_ibm_z	4.15
redhat	openshift_container_platform_for_ibm_z	4.16
redhat	openshift_container_platform_for_linuxone	4.12
redhat	openshift_container_platform_for_linuxone	4.13
redhat	openshift_container_platform_for_linuxone	4.14

Showing 30 of 37 entries