CVE-2024-9676 json
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)
published 2024-10-15 2 y ago modified 2026-11-05 3 d ago also EUVD-2024-50452
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
Patch / fix
- Red Hat Red Hat Enterprise Linux 8 8100020241101101019.afee755d
- Red Hat Red Hat Enterprise Linux 9 2:1.37.5-1.el9_5, 4:4.9.4-16.el9_4, 4:5.2.2-9.el9_5
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 2:1.33.11-1.el9_4
- Red Hat Red Hat OpenShift Container Platform 4.12 0:1.25.5-30.rhaos4.12.git53dc492.el8
- Red Hat Red Hat OpenShift Container Platform 4.13 0:1.26.5-26.rhaos4.13.giteb3d487.el8
- Red Hat Red Hat OpenShift Container Platform 4.14 0:1.27.8-12.rhaos4.14.git7597c43.el8, v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8
- Red Hat Red Hat OpenShift Container Platform 4.15 0:1.28.11-5.rhaos4.15.git35a2431.el8, v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8
- Red Hat Red Hat OpenShift Container Platform 4.16 0:1.29.9-6.rhaos4.16.gite7bd45a.el8, 4:4.9.4-12.rhaos4.16.el8, v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9
- Red Hat Red Hat OpenShift Container Platform 4.17 0:1.30.6-6.rhaos4.17.git6ac6e96.el8, 5:5.2.2-1.rhaos4.17.el8, v4.17.0-202501281204.p0.ga753153.assembly.stream.el9
- Red Hat Red Hat OpenShift Container Platform 4.18 0:0.6.6-0.rhaos4.18.el9.1, 0:0.9.3-4.el9, 0:0.16.0-20.gitf6c51c9.el9, 0:1.19.1-2.rhaos4.18.el9, 0:1.31.1-3.el9, 0:1.31.5-4.rhaos4.18.gitdad78d5.el8, 0:2.8.10-1.rhaos4.17.el9, 0:2.18.0-6.rhaos4.16.el9, 0:4.6-3.el9_0.3, 0:4.18.0-202411201308.p0.g006fe4e.assembly.stream.el8, 0:4.18.0-202411201308.p0.gc395190.assembly.stream.el8, 0:4.18.0-202412111238.p0.g9c24d76.assembly.stream.el8, 0:4.18.0-202502032331.p0.ga50d4c0.assembly.stream.el8, 0:4.18.0-202502051001.p0.gacb9630.assembly.stream.el8, 0:4.18.0-202502110932.p0.gd2acdd5.assembly.stream.el8, 0:5.14.0-427.50.2.el9_4, 2:1.33.7-4.rhaos4.18.el9, 3:1-86.rhaos4.18.el9, 3:2.1.12-7.rhaos4.18.el9, 4:2.234.2-2.rhaos4.18.el9
- golang-github-containers-storage Debian 14, Debian 13 1.55.1+ds1-1
debian advisories DEBIAN-CVE-2024-9676
- crit RHEL 8 3.18-5.module+el8.10.0+22417+2fb00970
- criu RHEL 8 3.18-5.module+el8.10.0+22417+2fb00970
- crun RHEL 8 1.14.3-2.module+el8.10.0+22417+2fb00970
- runc RHEL 8 1:1.1.12-5.module+el8.10.0+22417+2fb00970
- udica RHEL 8 0.2.6-21.module+el8.10.0+22417+2fb00970
- conmon RHEL 8 3:2.1.10-1.module+el8.10.0+22417+2fb00970
- podman RHEL 8 4:4.9.4-18.module+el8.10.0+22417+2fb00970
- skopeo RHEL 8 2:1.14.5-3.module+el8.10.0+22417+2fb00970
red hat advisories RHSA-2024:10289RHSA-2024:9926RHSA-2024:8984RHSA-2024:9051RHSA-2024:8700RHSA-2024:9459
- podman SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 4.9.5-150300.9.43.1
- skopeo Linux Micro 6.0 1.14.4-2.1
- podman Linux Micro 6.0 4.9.5-2.1
- podman SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 4.9.5-150400.4.35.1
- buildah SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.35.4-150300.8.28.3
- buildah SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.35.4-150400.3.33.1
- buildah SLE Module for Containers 15 SP6, SLE Module for Containers 15 SP5, openSUSE Leap 15.6 +1 more 1.35.4-150500.3.19.1
- podman SLE Module for Containers 15 SP6, SLE Module for Containers 15 SP5, SLE Micro 5.5 +3 more 4.9.5-150500.3.28.1
suse advisories SUSE-SU-2025:0775-1SUSE-SU-2025:20085-1SUSE-SU-2025:20080-1SUSE-SU-2025:0267-1SUSE-SU-2024:4303-1SUSE-SU-2024:3988-1
- skopeo openSUSE Tumbleweed 1.16.1-2.1
- podman openSUSE Tumbleweed 5.2.4-3.1
- buildah openSUSE Tumbleweed 1.37.5-1.1
opensuse advisories openSUSE-SU-2024:14562-1openSUSE-SU-2024:14420-1openSUSE-SU-2024:14418-1
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3901+4b80ecd7
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3858+6ad51f9f
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3926+f12484f5
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3909+6e1c1eb7
- crun AlmaLinux 8 1.14.3-2.module_el8.10.0+3845+87b84552
- crun AlmaLinux 8 1.14.3-2.module_el8.10.0+3909+6e1c1eb7
almalinux advisories ALSA-2024:10289ALSA-2024:9454ALSA-2024:9459ALSA-2024:9051
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
- crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
- runc Rocky Linux 8 1:1.1.12-5.module+el8.10.0+1874+ce489889
- udica Rocky Linux 8 0.2.6-21.module+el8.10.0+1815+5fe7415e
- conmon Rocky Linux 8 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
- podman Rocky Linux 8 4:4.9.4-18.module+el8.10.0+1896+b18fa106
- skopeo Rocky Linux 8 2:1.14.5-3.module+el8.10.0+1843+6892ab28
- buildah Rocky Linux 8 2:1.33.11-1.module+el8.10.0+1896+b18fa106
rocky linux advisories RLSA-2024:10289RLSA-2024:9051
- podman Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 5.2.5-r0
- buildah Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.37.5-r0
alpine advisories ALPINE-CVE-2024-9676
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- cri-o CBL-Mariner 2.0 1.22.3-14
- skopeo CBL-Mariner 2.0 1.14.2-9
- buildah Azure Linux 3.0 1.41.4-2
- podman Azure Linux 3.0 5.6.1-2
- skopeo Azure Linux 3.0 1.14.4-3
azure linux advisories AZL-50609AZL-50612AZL-50614AZL-50623AZL-50629
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-9676 updated cvss 6.5
Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
-
Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, jenkins-agent-base-rhel9-container, ocp-tools-4/jenkins-agent-base-rhel8affected: workaround, no fix available “Fix deferred”
-
Red Hat Enterprise Linux 9 skopeo, skopeo-tests Red Hat Enterprise Linux 10 podman, buildah Red Hat Quay 3 quay/quay-builder-rhel8affected: workaround, no fix available
-
Red Hat Ironic content for Red Hat OpenShift Container Platform 4.18 crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, python-ddt 1.6.0-1.el9, python-pbr 6.0.0-1.el9, python-amqp 5.0.6-1.el9, python-smi 0.3.4-10.el9, +323 morefixed: vendor fix RHEA-2024:6126
-
Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22417+2fb00970, criu 3.18-5.module+el8.10.0+22417+2fb00970, crun 1.14.3-2.module+el8.10.0+22417+2fb00970, runc 1.1.12-5.module+el8.10.0+22417+2fb00970, udica 0.2.6-21.module+el8.10.0+22417+2fb00970, conmon 2.1.10-1.module+el8.10.0+22417+2fb00970, +27 morefixed: vendor fix RHSA-2024:10289
-
Red Hat Enterprise Linux AppStream (v. 9) podman 5.2.2-9.el9_5, podman 4.9.4-16.el9_4, buildah 1.37.5-1.el9_5, podman-tests 5.2.2-9.el9_5, podman-docker 5.2.2-9.el9_5, podman-remote 5.2.2-9.el9_5, +6 morefixed: vendor fix RHSA-2024:9051
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) buildah 1.33.11-1.el9_4, buildah-tests 1.33.11-1.el9_4fixed: vendor fix RHSA-2024:9926
-
Red Hat OpenShift Container Platform 4.12 cri-o 1.25.5-5.rhaos4.12.git53dc492.el9, cri-o 1.25.5-30.rhaos4.12.git53dc492.el8fixed: vendor fix RHSA-2024:8694
-
Red Hat OpenShift Container Platform 4.13 cri-o 1.26.5-26.rhaos4.13.giteb3d487.el8, cri-o 1.26.5-26.rhaos4.13.giteb3d487.el9fixed: vendor fix RHSA-2024:8690
show 6 moreshow fewer
-
Red Hat OpenShift Container Platform 4.14 cri-o 1.27.8-12.rhaos4.14.git7597c43.el8, cri-o 1.27.8-12.rhaos4.14.git7597c43.el9, openshift4/ose-docker-builder v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8fixed: vendor fix RHSA-2024:8700
-
Red Hat OpenShift Container Platform 4.15 cri-o 1.28.11-5.rhaos4.15.git35a2431.el8, cri-o 1.28.11-5.rhaos4.15.git35a2431.el9, openshift4/ose-docker-builder v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8fixed: vendor fix RHSA-2024:8428
-
Red Hat OpenShift Container Platform 4.16 podman 4.9.4-12.rhaos4.16.el8, podman 4.9.4-14.rhaos4.16.el9, podman-tests 4.9.4-12.rhaos4.16.el8, podman-tests 4.9.4-14.rhaos4.16.el9, podman-docker 4.9.4-12.rhaos4.16.el8, podman-docker 4.9.4-14.rhaos4.16.el9, +9 morefixed: vendor fix RHSA-2024:8418
-
Red Hat OpenShift Container Platform 4.17 podman 5.2.2-1.rhaos4.17.el8, podman 5.2.2-1.rhaos4.17.el9, podman-tests 5.2.2-1.rhaos4.17.el8, podman-tests 5.2.2-1.rhaos4.17.el9, podman-docker 5.2.2-1.rhaos4.17.el8, podman-docker 5.2.2-1.rhaos4.17.el9, +9 morefixed: vendor fix RHSA-2024:8437
-
Red Hat OpenShift Container Platform 4.18 cri-tools 1.31.1-3.el9, libreswan 4.6-3.el9_0.3, ovn24.09 24.09.2-14.el9fdp, perf 5.14.0-427.50.2.el9_4, rtla 5.14.0-427.50.2.el9_4, crun 1.19.1-2.rhaos4.18.el9, +113 morefixed: vendor fix RHEA-2024:6126
-
Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 openstack-ironic 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-api 21.0.1-0.20240913135525.114badc.el9, python3-ironic-tests 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-common 21.0.1-0.20240913135525.114badc.el9, openstack-ironic-conductor 21.0.1-0.20240913135525.114badc.el9, python3-ironic-python-agent 9.0.1-0.20240913135525.2b2dd8f.el9, +3 more Red Hat Ironic content for Red Hat OpenShift Container Platform 4.16 python-zipp 3.19.1-1.el9, python3-zipp 3.19.1-1.el9 Red Hat Enterprise Linux 9 conmon Red Hat Enterprise Linux 10 skopeo Red Hat OpenShift Container Platform 4.12 cri-tools 1.25.0-5.el8, cri-tools 1.25.0-5.el9, runc 1.1.6-9.rhaos4.12.el8, conmon 2.1.2-8.rhaos4.12.el8, conmon 2.1.2-9.rhaos4.12.el9, podman 4.4.1-8.rhaos4.12.el8, +60 more Red Hat OpenShift Container Platform 4.13 cri-tools 1.26.0-7.el8, cri-tools 1.26.0-7.el9, runc 1.1.14-2.rhaos4.13.el8, runc 1.1.14-2.rhaos4.13.el9, conmon 2.1.7-5.rhaos4.13.el8, conmon 2.1.7-5.rhaos4.13.el9, +42 morenot affected: vulnerable code not present
+4 more productsfewer
Red Hat OpenShift Container Platform 4.14 libreswan 4.5-1.el9, cri-tools 1.27.0-6.el8, cri-tools 1.27.0-6.el9, rhcos 414.92.202503100617-0, runc 1.1.14-2.rhaos4.14.el8, runc 1.1.14-2.rhaos4.14.el9, +246 more Red Hat OpenShift Container Platform 4.15 cri-tools 1.28.0-7.el8, cri-tools 1.28.0-7.el9, perf 5.14.0-284.90.1.el9_2, rtla 5.14.0-284.90.1.el9_2, rhcos 415.92.202503060749-0, runc 1.1.14-2.rhaos4.15.el8, +301 more Red Hat OpenShift Container Platform 4.16 perf 5.14.0-427.42.1.el9_4, rtla 5.14.0-427.42.1.el9_4, rhcos 416.94.202503252048-0, bpftool 7.3.0-427.42.1.el9_4, kernel 5.14.0-427.42.1.el9_4, kernel-rt 5.14.0-427.42.1.el9_4, +267 more Red Hat OpenShift Container Platform 4.17 perf 5.14.0-427.42.1.el9_4, perf 5.14.0-427.44.1.el9_4, rtla 5.14.0-427.42.1.el9_4, rtla 5.14.0-427.44.1.el9_4, rhcos 417.94.202501301529-0, bpftool 7.3.0-427.42.1.el9_4, +329 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.32% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.12
- Red Hat Red Hat OpenShift Container Platform 4.13
- Red Hat Red Hat OpenShift Container Platform 4.14
- Red Hat Red Hat OpenShift Container Platform 4.15
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Developer Tools and Services
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Quay 3
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- github.com /containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679
-
access.redhat.com
/errata/RHEA-2024:6126
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:10289
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8418
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8428
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8437
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8686
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8690
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8694
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8700
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:8984
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:9051
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:9454
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:9459
vendor-advisory
-
access.redhat.com
/errata/RHSA-2024:9926
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:0876
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:2454
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:2710
vendor-advisory
-
access.redhat.com
/errata/RHSA-2025:3301
vendor-advisory
-
access.redhat.com
/security/cve/CVE-2024-9676
vdb-entry, vendor-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2317467
issue-tracking
-
github.com
/advisories/GHSA-wq2p-5pc6-wpgf
third-party-advisory
Sources
- CVE List CVE-2024-9676
- NVD CVE-2024-9676
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.