A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-testsUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade buildah-testsUpgrade criu-develUpgrade libslirpUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade libslirp-develUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade container-selinuxUpgrade conmonUpgrade skopeo-testsUpgrade python3-criuUpgrade criu-libsUpgrade podman-dockerUpgrade skopeoUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade criuUpgrade podman-catatonitUpgrade podmanUpgrade critUpgrade netavarkUpgrade podman-remoteUpgrade udicaUpgrade crunUpgrade buildahUpgrade toolbox-testsUpgrade runcUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade toolbox | Nov 12, 2024 | Oct 15, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Oct 15, 2024 |
| Debian | — | Upgrade golang-github-containers-storage | May 15, 2025 | Oct 15, 2024 |
| Oracle_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade crunUpgrade criu-develUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade skopeoUpgrade container-selinuxUpgrade podman-pluginsUpgrade skopeo-testsUpgrade libslirp-develUpgrade criu-libsUpgrade podmanUpgrade podman-remoteUpgrade buildahUpgrade podman-testsUpgrade fuse-overlayfsUpgrade criuUpgrade conmonUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade buildah-testsUpgrade runcUpgrade udicaUpgrade slirp4netnsUpgrade critUpgrade netavarkUpgrade podman-gvproxyUpgrade podman-dockerUpgrade podman-catatonitUpgrade libslirp | Nov 21, 2024 | Oct 15, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade podman | Oct 30, 2024 | Oct 15, 2024 |
| Redhat_linux | — | Upgrade buildah-testsUpgrade cockpit-podmanUpgrade libslirpUpgrade netavarkUpgrade buildah-tests-debuginfoUpgrade python3-podmanUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade podman-catatonitUpgrade criu-libs-debuginfoUpgrade podmanUpgrade udicaUpgrade runc-debugsourceUpgrade skopeoUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade toolbox-debugsourceUpgrade podman-dockerUpgrade aardvark-dnsUpgrade toolbox-testsNo solution existsUpgrade podman-testsUpgrade buildahUpgrade criu-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade fuse-overlayfs-debugsourceUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade podman-debugsourceUpgrade python3-criuUpgrade skopeo-testsUpgrade podman-pluginsUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debugsourceUpgrade crunUpgrade criu-develUpgrade toolboxUpgrade runc-debuginfoUpgrade criu-libsUpgrade libslirp-debuginfoUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade libslirp-develUpgrade conmonUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade runcUpgrade buildah-debugsourceUpgrade crun-debuginfoUpgrade containers-commonUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade toolbox-debuginfo | Nov 13, 2024 | Oct 15, 2024 |
| Rocky_linux | — | Upgrade podman-debugsourceUpgrade criu-libsUpgrade podman-catatonit-debuginfoUpgrade conmonUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade crun-debuginfoUpgrade toolboxUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade skopeoUpgrade buildah-debugsourceUpgrade crunUpgrade libslirp-debugsourceUpgrade skopeo-testsUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-criuUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade toolbox-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade runcUpgrade podman-catatonitUpgrade critUpgrade criu-debugsourceUpgrade podmanUpgrade buildahUpgrade fuse-overlayfsUpgrade criu-libs-debuginfoUpgrade podman-debuginfoUpgrade libslirpUpgrade buildah-debuginfoUpgrade conmon-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade netavarkUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-remoteUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade toolbox-testsUpgrade buildah-testsUpgrade criuUpgrade conmon-debugsourceUpgrade aardvark-dnsUpgrade runc-debugsource | Nov 20, 2024 | Oct 15, 2024 |
| Suse | — | Upgrade skopeo-bash-completionUpgrade skopeo-zsh-completionUpgrade skopeoUpgrade podman-dockerUpgrade podmanUpgrade buildahUpgrade podmanshUpgrade skopeo-fish-completionUpgrade podman-remote | Dec 31, 2024 | Oct 15, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub