A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade netavarkUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade criuUpgrade udicaUpgrade podmanUpgrade toolbox-testsUpgrade podman-pluginsUpgrade runcUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade toolboxUpgrade crunUpgrade skopeoUpgrade buildahUpgrade critUpgrade container-selinuxUpgrade libslirpUpgrade skopeo-testsUpgrade podman-dockerUpgrade buildah-testsUpgrade python3-criuUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade criu-develUpgrade podman-gvproxyUpgrade podman-testsUpgrade containers-commonUpgrade libslirp-develUpgrade slirp4netnsUpgrade criu-libs | Nov 12, 2024 | Oct 15, 2024 |
| Alpine Linux | — | Upgrade buildahUpgrade podman | Aug 8, 2025 | Oct 15, 2024 |
| Debian | — | Upgrade golang-github-containers-storageNo solution exists | May 15, 2025 | Oct 15, 2024 |
| Oracle_linux | — | Upgrade podman-testsUpgrade libslirpUpgrade netavarkUpgrade cockpit-podmanUpgrade runcUpgrade critUpgrade buildah-testsUpgrade udicaUpgrade conmonUpgrade criuUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade buildahUpgrade podman-dockerUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade libslirp-develUpgrade podman-pluginsUpgrade crunUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade container-selinuxUpgrade python3-criuUpgrade skopeo-testsUpgrade podmanUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade containers-commonUpgrade python3-podmanUpgrade criu-devel | Nov 21, 2024 | Oct 15, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade podman | Oct 30, 2024 | Oct 15, 2024 |
| Redhat_linux | — | Upgrade slirp4netns-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade conmonUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade criu-develUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade runcUpgrade containers-commonUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade container-selinuxUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade runc-debuginfoUpgrade toolboxUpgrade crunUpgrade critUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-pluginsUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade podman-testsUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade netavarkUpgrade toolbox-debugsourceUpgrade conmon-debugsourceUpgrade python3-podmanUpgrade skopeoUpgrade slirp4netnsUpgrade buildah-testsUpgrade libslirpUpgrade cockpit-podmanNo solution existsUpgrade podman-dockerUpgrade toolbox-testsUpgrade criuUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade buildahUpgrade podman-gvproxyUpgrade podmanUpgrade runc-debugsourceUpgrade udicaUpgrade criu-libs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfsUpgrade aardvark-dns | Nov 13, 2024 | Oct 15, 2024 |
| Rocky_linux | — | Upgrade criu-debugsourceUpgrade podman-gvproxyUpgrade netavarkUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade slirp4netnsUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade podman-remoteUpgrade conmon-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debuginfoUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade libslirpUpgrade runc-debugsourceUpgrade criuUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade critUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade buildahUpgrade runcUpgrade skopeoUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade conmonUpgrade crun-debuginfoUpgrade containers-commonUpgrade criu-libsUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade podman-catatonit-debuginfoUpgrade runc-debuginfoUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade libslirp-debugsourceUpgrade crunUpgrade criu-develUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirp-develUpgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-plugins | Nov 20, 2024 | Oct 15, 2024 |
| Suse | — | Upgrade podmanshUpgrade buildahUpgrade skopeo-fish-completionUpgrade podman-remoteUpgrade skopeo-zsh-completionUpgrade skopeo-bash-completionUpgrade skopeoUpgrade podmanUpgrade podman-docker | Dec 31, 2024 | Oct 15, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub