A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade podman-dockerUpgrade python3-criuUpgrade conmonUpgrade cockpit-podmanUpgrade criu-develUpgrade criu-libsUpgrade skopeo-testsUpgrade buildah-testsUpgrade podman-testsUpgrade podman-gvproxyUpgrade libslirpUpgrade containers-commonUpgrade libslirp-develUpgrade toolbox-testsUpgrade runcUpgrade crunUpgrade udicaUpgrade podman-catatonitUpgrade podmanUpgrade toolboxUpgrade podman-pluginsUpgrade skopeoUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade criuUpgrade critUpgrade netavarkUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade buildah | Nov 12, 2024 | Oct 15, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Aug 8, 2025 | Oct 15, 2024 |
| Debian | — | Upgrade golang-github-containers-storageNo solution exists | May 15, 2025 | Oct 15, 2024 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade criu-develUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade podmanUpgrade crunUpgrade criu-libsUpgrade podman-pluginsUpgrade podman-remoteUpgrade skopeo-testsUpgrade libslirp-develUpgrade python3-criuUpgrade podman-testsUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade buildahUpgrade udicaUpgrade runcUpgrade buildah-testsUpgrade libslirpUpgrade cockpit-podmanUpgrade netavarkUpgrade critUpgrade podman-gvproxyUpgrade podman-dockerUpgrade podman-catatonitUpgrade aardvark-dnsUpgrade criuUpgrade conmon | Nov 21, 2024 | Oct 15, 2024 |
| Redhat Openshift | — | Upgrade podmanUpgrade cri-o | Oct 30, 2024 | Oct 15, 2024 |
| Redhat_linux | — | Upgrade libslirp-develUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade critUpgrade crun-debugsourceUpgrade criu-libsUpgrade skopeo-testsUpgrade toolbox-debuginfoUpgrade podman-catatonit-debuginfoUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade crunUpgrade criu-develUpgrade podman-remoteUpgrade runcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade conmonUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debugsourceUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade podmanUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade netavarkUpgrade conmon-debugsourceUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade podman-dockerUpgrade skopeoUpgrade fuse-overlayfs-debuginfoNo solution existsUpgrade cockpit-podmanUpgrade udicaUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade buildahUpgrade toolbox-testsUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade python3-podmanUpgrade toolbox-debugsourceUpgrade podman-testsUpgrade buildah-debuginfoUpgrade criuUpgrade conmon-debuginfoUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade libslirp | Nov 13, 2024 | Oct 15, 2024 |
| Rocky_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade containers-commonUpgrade criu-libsUpgrade conmonUpgrade podman-catatonit-debuginfoUpgrade libslirp-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-debugsourceUpgrade python3-criuUpgrade runc-debuginfoUpgrade toolbox-debuginfoUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade toolboxUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade crun-debugsourceUpgrade libslirp-debugsourceUpgrade skopeoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade crunUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade podmanUpgrade podman-catatonitUpgrade runcUpgrade critUpgrade buildahUpgrade toolbox-testsUpgrade libslirpUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade podman-debuginfoUpgrade fuse-overlayfsUpgrade criu-libs-debuginfoUpgrade criuUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade podman-gvproxyUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade podman-tests | Nov 20, 2024 | Oct 15, 2024 |
| Suse | — | Upgrade podman-dockerUpgrade skopeo-bash-completionUpgrade skopeoUpgrade skopeo-zsh-completionUpgrade podmanUpgrade skopeo-fish-completionUpgrade podman-remoteUpgrade buildahUpgrade podmansh | Dec 31, 2024 | Oct 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub