Vulnerability Description
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openshift Container Platform | 4.12 |
| Redhat | Openshift Container Platform For Arm64 | 4.12 |
| Redhat | Openshift Container Platform For Ibm Z | 4.12 |
| Redhat | Openshift Container Platform For Linuxone | 4.12 |
| Redhat | Openshift Container Platform For Power | 4.12 |
| Redhat | Enterprise Linux | 9.0 |
| Redhat | Enterprise Linux Eus | 9.4 |
| Redhat | Enterprise Linux For Arm 64 | 9.0_aarch64 |
| Redhat | Enterprise Linux For Arm 64 Eus | 9.4_aarch64 |
| Redhat | Enterprise Linux For Ibm Z Systems | 9.0_s390x |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 9.4_s390x |
| Redhat | Enterprise Linux For Power Little Endian | 9.0_ppc64le |
| Redhat | Enterprise Linux For Power Little Endian Eus | 9.4_ppc64le |
| Redhat | Enterprise Linux Server Aus | 9.4 |
| Redhat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | 9.4_ppc64le |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2024:10289
- https://access.redhat.com/errata/RHSA-2024:8418Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8428Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8437Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8686Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8690Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8694Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8700Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:8984Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:9051Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:9454Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:9459Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:9926Vendor Advisory
- https://access.redhat.com/errata/RHSA-2025:0876
- https://access.redhat.com/errata/RHSA-2025:2454
FAQ
What is CVE-2024-9676?
CVE-2024-9676 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of serv...
How severe is CVE-2024-9676?
CVE-2024-9676 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-9676?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Openshift Container Platform, Redhat Openshift Container Platform For Arm64, Redhat Openshift Container Platform For Ibm Z, Redhat Openshift Container Platform For Linuxone, Redhat Openshift Container Platform For Power.