A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolbox-testsUpgrade container-selinuxUpgrade podman-gvproxyUpgrade criuUpgrade cockpit-podmanUpgrade conmonUpgrade slirp4netnsUpgrade podman-dockerUpgrade python3-podmanUpgrade buildahUpgrade buildah-testsUpgrade netavarkUpgrade podman-catatonitUpgrade libslirpUpgrade udicaUpgrade crunUpgrade fuse-overlayfsUpgrade toolboxUpgrade podman-testsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade runcUpgrade criu-libsUpgrade libslirp-develUpgrade critUpgrade podman-pluginsUpgrade podmanUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade skopeoUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade containers-common | Oct 16, 2024 | Oct 1, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Oct 10, 2024 | Oct 1, 2024 |
| Debian | — | Upgrade golang-github-containers-commonNo solution exists | May 15, 2025 | Oct 1, 2024 |
| Oracle_linux | — | Upgrade aardvark-dnsUpgrade podman-catatonitUpgrade netavarkUpgrade podmanUpgrade podman-dockerUpgrade runcUpgrade criuUpgrade buildah-testsUpgrade podman-remoteUpgrade python3-podmanUpgrade libslirpUpgrade fuse-overlayfsUpgrade critUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade buildahUpgrade podman-testsUpgrade slirp4netnsUpgrade conmonUpgrade skopeo-testsUpgrade skopeoUpgrade criu-libsUpgrade python3-criuUpgrade crunUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade containers-commonUpgrade criu-devel | Oct 16, 2024 | Oct 1, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade rhcos | Oct 17, 2024 | Oct 1, 2024 |
| Redhat_linux | — | Upgrade podman-testsUpgrade buildah-testsUpgrade criuUpgrade fuse-overlayfsUpgrade libslirp-debuginfoUpgrade podman-dockerUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade runc-debugsourceUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade buildahUpgrade toolbox-debuginfoUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade toolbox-testsUpgrade python3-criuUpgrade container-selinuxUpgrade cockpit-podmanUpgrade criu-debugsourceUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade libslirpUpgrade crun-debuginfoUpgrade podman-plugins-debuginfoUpgrade udicaUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-catatonitUpgrade podman-debugsourceUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade runcUpgrade python3-podmanUpgrade podman-remoteUpgrade criu-develUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade crun-debugsourceUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade libslirp-develUpgrade critUpgrade conmonUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debugsourceUpgrade podmanUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade skopeo-tests | Oct 16, 2024 | Oct 1, 2024 |
| Rocky_linux | — | Upgrade slirp4netns-debugsourceUpgrade podman-gvproxyUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade buildah-debugsourceUpgrade crunUpgrade critUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debuginfoUpgrade python3-criuUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade conmon-debuginfoUpgrade runcUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade podman-remoteUpgrade crun-debuginfoUpgrade libslirp-debuginfoUpgrade libslirp-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade toolboxUpgrade buildahUpgrade toolbox-testsUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade containers-commonUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debuginfoUpgrade skopeoUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade conmon-debugsourceUpgrade netavarkUpgrade buildah-testsUpgrade conmonUpgrade criu-libs | Nov 4, 2024 | Oct 1, 2024 |
| Suse | — | Upgrade podman-remoteUpgrade govulncheck-vulndbUpgrade podmanshUpgrade podman-dockerUpgrade podmanUpgrade buildah | Dec 31, 2024 | Oct 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub