A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade udicaUpgrade podman-catatonitUpgrade libslirpUpgrade buildah-testsUpgrade netavarkUpgrade toolbox-testsUpgrade conmonUpgrade cockpit-podmanUpgrade podman-dockerUpgrade python3-podmanUpgrade criuUpgrade podman-testsUpgrade buildahUpgrade crunUpgrade toolboxUpgrade containers-commonUpgrade aardvark-dnsUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade criu-libsUpgrade podman-remoteUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade criu-develUpgrade skopeo-testsUpgrade python3-criuUpgrade podmanUpgrade critUpgrade skopeo | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-common | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade skopeoUpgrade criu-develUpgrade libslirp-develUpgrade container-selinuxUpgrade containers-commonUpgrade python3-criuUpgrade conmonUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade crunUpgrade podman-pluginsUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade runcUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade buildahUpgrade critUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade netavarkUpgrade buildah-testsUpgrade podman-remoteUpgrade podmanUpgrade podman-dockerUpgrade slirp4netnsUpgrade podman-testsUpgrade libslirpUpgrade criuUpgrade python3-podman | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcos | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade fuse-overlayfsUpgrade container-selinuxUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade libslirpUpgrade python3-criuUpgrade toolbox-testsUpgrade podman-testsUpgrade podman-dockerUpgrade udicaUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade cockpit-podmanUpgrade criuUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade podman-gvproxyUpgrade buildahUpgrade conmon-debuginfoUpgrade crun-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade netavarkUpgrade podmanUpgrade containers-commonUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade runcUpgrade python3-podmanUpgrade crun-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade criu-develUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-develUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-catatonit-debuginfoUpgrade critUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runc-debuginfoUpgrade crunUpgrade criu-libsUpgrade skopeoUpgrade podman-pluginsUpgrade podman-catatonitUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade criuUpgrade criu-debuginfoUpgrade podmanUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade buildah-debuginfoUpgrade criu-libsUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade criu-debugsourceUpgrade skopeoUpgrade conmon-debugsourceUpgrade netavarkUpgrade podman-catatonitUpgrade buildah-testsUpgrade conmonUpgrade toolbox-testsUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade toolboxUpgrade criu-develUpgrade libslirp-debugsourceUpgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade podman-testsUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade slirp4netns-debugsourceUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-debugsourceUpgrade runcUpgrade toolbox-debuginfo | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade buildahUpgrade podmanUpgrade podman-dockerUpgrade podmanshUpgrade govulncheck-vulndbUpgrade podman-remote | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub