Loading vulnerability…
Symlink Traversal Denial of Service in containers/storage
CVE-2024-9676 is a symlink traversal vulnerability in the containers/storage library used by Podman, Buildah, and CRI-O. When processing a malicious container image with an automatically assigned user namespace, the library reads the container's user account database without adequately validating whether it is a symbolic link. An attacker-controlled link can redirect this read to an arbitrary host file, causing the affected container tooling to hang and potentially terminate through an out-of-memory kill.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can disrupt container operations by causing Podman, Buildah, or CRI-O to hang or be terminated by the out-of-memory killer. Although the library can be induced to read arbitrary host files, disclosure of their contents to the attacker is not established. Code execution, privilege escalation, and integrity compromise are not established.
If you can’t patch tonight, do this now.
No broadly applicable mitigation meeting Red Hat's product-security criteria was identified. Apply the relevant vendor security updates.
Patch, then assume compromise.
Install vendor updates that incorporate the containers/storage fix, updating affected Podman, Buildah, and CRI-O packages or container images as applicable. Red Hat Enterprise Linux 8 updates are available through RHSA-2024:10289; Red Hat Enterprise Linux 9 Podman updates through RHSA-2024:9051 and RHSA-2024:9454; and RHEL 9 Buildah updates through RHSA-2024:9459, with RHEL 9.4 Extended Update Support covered by RHSA-2024:9926. For OpenShift, apply the appropriate supported release-channel update containing the corrected packages and images.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.