Skip to content
Fencer Vulns
medium 5.4

CVE-2024-9341 json

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

published 2024-10-01 2 y ago modified 2026-11-05 3 d ago also GHSA-mc76-5925-c5p6 , GO-2024-3171 , EUVD-2024-3079

cvss
5.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

Patch / fix

  • go github.com/containers/common 0.60.4
  • Red Hat Red Hat Enterprise Linux 8 8100020241023085649.afee755d
  • Red Hat Red Hat Enterprise Linux 9 2:1.33.9-1.el9_4, 2:1.37.5-1.el9_5, 4:4.9.4-13.el9_4, 4:5.2.2-9.el9_5
  • Red Hat Red Hat OpenShift Container Platform 4.12 0:1.25.5-30.rhaos4.12.git53dc492.el8
  • Red Hat Red Hat OpenShift Container Platform 4.13 0:1.26.5-26.rhaos4.13.giteb3d487.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 0:1.27.8-10.rhaos4.14.git807f92c.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 0:1.28.11-5.rhaos4.15.git35a2431.el8
  • Red Hat Red Hat OpenShift Container Platform 4.16 0:1.29.9-5.rhaos4.16.git34690b9.el8, 416.94.202411201433-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 0:1.30.6-3.rhaos4.17.git49b5172.el8, 417.94.202412040832-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 0:0.6.6-0.rhaos4.18.el9.1, 0:0.9.3-4.el9, 0:0.16.0-20.gitf6c51c9.el9, 0:1.19.1-2.rhaos4.18.el9, 0:1.31.1-3.el9, 0:1.31.5-4.rhaos4.18.gitdad78d5.el8, 0:2.8.10-1.rhaos4.17.el9, 0:2.18.0-6.rhaos4.16.el9, 0:4.6-3.el9_0.3, 0:4.18.0-202411201308.p0.g006fe4e.assembly.stream.el8, 0:4.18.0-202411201308.p0.gc395190.assembly.stream.el8, 0:4.18.0-202412111238.p0.g9c24d76.assembly.stream.el8, 0:4.18.0-202502032331.p0.ga50d4c0.assembly.stream.el8, 0:4.18.0-202502051001.p0.gacb9630.assembly.stream.el8, 0:4.18.0-202502110932.p0.gd2acdd5.assembly.stream.el8, 0:5.14.0-427.50.2.el9_4, 2:1.33.7-4.rhaos4.18.el9, 3:1-86.rhaos4.18.el9, 3:2.1.12-7.rhaos4.18.el9, 4:2.234.2-2.rhaos4.18.el9
  • golang-github-containers-common Debian 14, Debian 13 0.60.4+ds1-1

debian advisories DEBIAN-CVE-2024-9341

  • buildah RHEL 9 2:1.37.5-1.el9_5
  • buildah-tests RHEL 9 2:1.37.5-1.el9_5
  • cri-o openshift 4.12 1.25.5-30.rhaos4.12.git53dc492.el8
  • cri-o openshift 4.12 1.25.5-5.rhaos4.12.git53dc492.el9
  • podman openshift 4.12 3:4.4.1-8.rhaos4.12.el8
  • podman openshift 4.12 3:4.2.0-12.rhaos4.12.el9
  • skopeo openshift 4.12 2:1.9.4-7.rhaos4.12.el8
  • skopeo openshift 4.12 2:1.9.4-7.rhaos4.12.el9

red hat advisories RHSA-2024:9459RHSA-2024:8694RHSA-2024:9454RHSA-2024:8690RHSA-2024:8846RHSA-2024:8428

  • podman SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 4.9.5-150300.9.43.1
  • podman Linux Micro 6.0 4.9.5-2.1
  • podman SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 4.9.5-150400.4.35.1
  • buildah SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.35.4-150300.8.28.3
  • buildah SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.35.4-150400.3.33.1
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +1 more 0.0.20241030T212825-150000.1.9.1
  • podman SLE Module for Containers 15 SP6, SLE Module for Containers 15 SP5, SLE Micro 5.5 +3 more 4.9.5-150500.3.18.1
  • buildah SLE Module for Containers 15 SP6, SLE Module for Containers 15 SP5, openSUSE Leap 15.6 +1 more 1.35.4-150500.3.13.1

suse advisories SUSE-SU-2025:0775-1SUSE-SU-2025:20080-1SUSE-SU-2025:0267-1SUSE-SU-2024:4303-1SUSE-SU-2024:3988-1SUSE-SU-2024:3911-1

  • govulncheck-vulndb Package Hub 12 0.0.20241104T154416-5.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20241030T212825-1.1
  • buildah openSUSE Tumbleweed 1.37.4-1.1
  • podman openSUSE Tumbleweed 5.2.4-1.1

opensuse advisories openSUSE-SU-2024:0350-1openSUSE-SU-2024:14447-1openSUSE-SU-2024:14388-1openSUSE-SU-2024:14390-1

  • podman AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-tests AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-docker AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-remote AlmaLinux 9 4:5.2.2-9.el9_5
  • podman-plugins AlmaLinux 9 4:5.2.2-9.el9_5
  • buildah AlmaLinux 9 2:1.37.5-1.el9_5
  • buildah-tests AlmaLinux 9 2:1.37.5-1.el9_5
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3901+4b80ecd7

almalinux advisories ALSA-2024:9454ALSA-2024:9459ALSA-2024:8846ALSA-2024:8112ALSA-2024:8039

  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-5.module+el8.10.0+1874+ce489889
  • udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
  • conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
  • podman Rocky Linux 8 4:4.9.4-15.module+el8.10.0+1880+8e896d1b
  • skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28
  • buildah Rocky Linux 8 2:1.33.10-1.module+el8.10.0+1880+8e896d1b

rocky linux advisories RLSA-2024:8846RLSA-2024:8039

  • podman Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 5.2.4-r0
  • buildah Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.37.4-r0

alpine advisories ALPINE-CVE-2024-9341

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • podman Azure Linux 3.0 5.6.1-2
  • cri-o CBL-Mariner 2.0 1.22.3-9

azure linux advisories AZL-50070AZL-50103

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-9341 updated cvss 5.4

Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library

  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.18 crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, python-ddt 1.6.0-1.el9, python-pbr 6.0.0-1.el9, python-amqp 5.0.6-1.el9, python-smi 0.3.4-10.el9, +323 more
    fixed: vendor fix RHEA-2024:6126
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22397+e3c95ba6, criu 3.18-5.module+el8.10.0+22397+e3c95ba6, crun 1.14.3-2.module+el8.10.0+22397+e3c95ba6, runc 1.1.12-5.module+el8.10.0+22397+e3c95ba6, udica 0.2.6-21.module+el8.10.0+22397+e3c95ba6, conmon 2.1.10-1.module+el8.10.0+22397+e3c95ba6, +27 more
    fixed: vendor fix RHSA-2024:8846
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.2.2-9.el9_5, podman 4.9.4-13.el9_4, buildah 1.33.9-1.el9_4, buildah 1.37.5-1.el9_5, podman-tests 5.2.2-9.el9_5, podman-docker 5.2.2-9.el9_5, +8 more
    fixed: vendor fix RHSA-2024:8112
  • Red Hat OpenShift Container Platform 4.12 cri-o 1.25.5-5.rhaos4.12.git53dc492.el9, cri-o 1.25.5-30.rhaos4.12.git53dc492.el8
    fixed: vendor fix RHSA-2024:8694
  • Red Hat OpenShift Container Platform 4.13 cri-o 1.26.5-26.rhaos4.13.giteb3d487.el8, cri-o 1.26.5-26.rhaos4.13.giteb3d487.el9
    fixed: vendor fix RHSA-2024:8690
  • Red Hat OpenShift Container Platform 4.14 cri-o 1.27.8-10.rhaos4.14.git807f92c.el8, cri-o 1.27.8-10.rhaos4.14.git807f92c.el9
    fixed: vendor fix RHSA-2024:8238
  • Red Hat OpenShift Container Platform 4.15 cri-o 1.28.11-5.rhaos4.15.git35a2431.el8, cri-o 1.28.11-5.rhaos4.15.git35a2431.el9
    fixed: vendor fix RHSA-2024:8428
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202411201433-0, cri-o 1.29.9-5.rhaos4.16.git34690b9.el8, cri-o 1.29.9-5.rhaos4.16.git34690b9.el9
    fixed: vendor fix RHSA-2024:8263
show 3 more
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202412040832-0, cri-o 1.30.6-3.rhaos4.17.git49b5172.el8, cri-o 1.30.6-3.rhaos4.17.git49b5172.el9
    fixed: vendor fix RHSA-2024:7925
  • Red Hat OpenShift Container Platform 4.18 cri-tools 1.31.1-3.el9, libreswan 4.6-3.el9_0.3, ovn24.09 24.09.2-14.el9fdp, perf 5.14.0-427.50.2.el9_4, rtla 5.14.0-427.50.2.el9_4, crun 1.19.1-2.rhaos4.18.el9, +303 more
    fixed: vendor fix RHEA-2024:6126
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 openstack-ironic 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-api 21.0.1-0.20240913135525.114badc.el9, python3-ironic-tests 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-common 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-conductor 21.0.1-0.20240913135525.114badc.el9, python3-ironic-python-agent 9.0.1-0.20240913135525.2b2dd8f.el9, +3 more Red Hat Enterprise Linux 10 podman, buildah Red Hat OpenShift Container Platform 4.12 cri-tools 1.25.0-5.el8, cri-tools 1.25.0-5.el9, runc 1.1.6-9.rhaos4.12.el8, conmon 2.1.2-8.rhaos4.12.el8, conmon 2.1.2-9.rhaos4.12.el9, podman 4.4.1-8.rhaos4.12.el8, +60 more Red Hat OpenShift Container Platform 4.13 cri-tools 1.26.0-7.el8, cri-tools 1.26.0-7.el9, runc 1.1.14-2.rhaos4.13.el8, runc 1.1.14-2.rhaos4.13.el9, conmon 2.1.7-5.rhaos4.13.el8, conmon 2.1.7-5.rhaos4.13.el9, +42 more Red Hat OpenShift Container Platform 4.14 cri-o 1.27.8-10.rhaos4.14.git807f92c.el9, container-selinux 2.228.1-1.rhaos4.14.el8, container-selinux 2.228.1-1.rhaos4.14.el9 Red Hat OpenShift Container Platform 4.15 cri-tools 1.28.0-7.el8, cri-tools 1.28.0-7.el9, perf 5.14.0-284.90.1.el9_2, rtla 5.14.0-284.90.1.el9_2, runc 1.1.14-2.rhaos4.15.el8, runc 1.1.14-2.rhaos4.15.el9, +118 more
    +2 more products
    Red Hat OpenShift Container Platform 4.16 cri-tools 1.29.0-6.el8, cri-tools 1.29.0-6.el9, runc 1.1.14-3.rhaos4.16.el8, runc 1.1.14-3.rhaos4.16.el9, butane 0.21.0-4.rhaos4.16.el8, conmon 2.1.10-5.rhaos4.16.el8, +243 more Red Hat OpenShift Container Platform 4.17 crun 1.17-1.rhaos4.17.el8, crun 1.17-1.rhaos4.17.el9, perf 5.14.0-427.40.1.el9_4, rtla 5.14.0-427.40.1.el9_4, runc 1.1.14-1.rhaos4.17.el8, runc 1.1.14-1.rhaos4.17.el9, +130 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containers/common
<0.60.4
0.60.4

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat Enterprise Linux 10

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.