A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolbox-testsUpgrade buildahUpgrade toolboxUpgrade criuUpgrade container-selinuxUpgrade podman-gvproxyUpgrade buildah-testsUpgrade python3-podmanUpgrade netavarkUpgrade udicaUpgrade libslirpUpgrade crunUpgrade podman-dockerUpgrade podman-catatonitUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade podman-testsUpgrade cockpit-podmanUpgrade conmonUpgrade criu-libsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade podmanUpgrade podman-pluginsUpgrade libslirp-develUpgrade runcUpgrade criu-develUpgrade critUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade skopeo | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-commonNo solution exists | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade buildahUpgrade criuUpgrade libslirpUpgrade podman-gvproxyUpgrade podmanUpgrade cockpit-podmanUpgrade podman-testsUpgrade slirp4netnsUpgrade podman-dockerUpgrade podman-catatonitUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade critUpgrade python3-podmanUpgrade podman-remoteUpgrade runcUpgrade netavarkUpgrade aardvark-dnsUpgrade python3-criuUpgrade conmonUpgrade skopeo-testsUpgrade skopeoUpgrade crunUpgrade containers-commonUpgrade podman-pluginsUpgrade criu-libsUpgrade libslirp-develUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade container-selinux | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcos | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade crun-debugsourceUpgrade critUpgrade criu-libsUpgrade crunUpgrade runcUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-develUpgrade python3-podmanUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debugsourceUpgrade containers-commonUpgrade skopeo-testsUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podmanUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade libslirp-debuginfoUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade python3-criuUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade crun-debuginfoUpgrade toolbox-debuginfoUpgrade udicaUpgrade podman-plugins-debuginfoUpgrade cockpit-podmanUpgrade libslirpUpgrade buildah-testsUpgrade podman-testsUpgrade criuUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade buildahUpgrade criu-debuginfoUpgrade container-selinuxUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade podman-gvproxy-debuginfoUpgrade podman-dockerUpgrade buildah-tests-debuginfo | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade toolbox-testsUpgrade buildahUpgrade criuUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade podman-catatonit-debuginfoUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade criu-libsUpgrade conmon-debugsourceUpgrade netavarkUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade containers-commonUpgrade crun-debugsourceUpgrade podmanUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade containernetworking-plugins-debugsourceUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade runcUpgrade libslirp-develUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade python3-criuUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade toolbox-debuginfoUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debugsource | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podmanUpgrade podman-dockerUpgrade buildahUpgrade podmanshUpgrade podman-remoteUpgrade govulncheck-vulndb | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub