A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criu-libsUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade libslirp-develUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade python3-criuUpgrade buildah-testsUpgrade container-selinuxUpgrade conmonUpgrade podman-testsUpgrade podman-dockerUpgrade podman-gvproxyUpgrade criu-develUpgrade libslirpUpgrade skopeo-testsUpgrade toolbox-testsUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade podmanUpgrade skopeoUpgrade buildahUpgrade runcUpgrade podman-remoteUpgrade critUpgrade toolboxUpgrade crunUpgrade udicaUpgrade netavarkUpgrade criuUpgrade podman-catatonitUpgrade fuse-overlayfs | Nov 12, 2024 | Oct 15, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Oct 15, 2024 |
| Debian | — | Upgrade golang-github-containers-storageNo solution exists | May 15, 2025 | Oct 15, 2024 |
| Oracle_linux | — | Upgrade slirp4netnsUpgrade critUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade netavarkUpgrade buildah-testsUpgrade cockpit-podmanUpgrade libslirpUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade buildahUpgrade podman-testsUpgrade udicaUpgrade runcUpgrade conmonUpgrade criuUpgrade podman-dockerUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade python3-criuUpgrade libslirp-develUpgrade criu-libsUpgrade crunUpgrade podman-remoteUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade python3-podmanUpgrade skopeoUpgrade containers-commonUpgrade criu-develUpgrade skopeo-tests | Nov 21, 2024 | Oct 15, 2024 |
| Redhat Openshift | — | Upgrade podmanUpgrade cri-o | Oct 30, 2024 | Oct 15, 2024 |
| Redhat_linux | — | Upgrade crun-debugsourceUpgrade libslirp-debugsourceUpgrade criu-develUpgrade runc-debuginfoUpgrade toolboxUpgrade podman-pluginsUpgrade python3-criuUpgrade podman-debugsourceUpgrade crun-debuginfoUpgrade containers-commonUpgrade libslirp-develUpgrade toolbox-debuginfoUpgrade runcUpgrade libslirp-debuginfoUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade container-selinuxUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade criu-libsUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade crunUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade podmanUpgrade buildahUpgrade udicaUpgrade python3-podmanUpgrade netavarkUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-testsUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade buildah-testsUpgrade podman-testsUpgrade skopeoUpgrade aardvark-dnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade libslirpUpgrade conmon-debugsourceNo solution existsUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-debugsourceUpgrade criuUpgrade slirp4netnsUpgrade fuse-overlayfs | Nov 13, 2024 | Oct 15, 2024 |
| Rocky_linux | — | Upgrade podman-remote-debuginfoUpgrade python3-criuUpgrade criu-develUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-debugsourceUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-debugsourceUpgrade criu-libsUpgrade podman-catatonit-debuginfoUpgrade podman-plugins-debuginfoUpgrade runc-debuginfoUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-develUpgrade crun-debugsourceUpgrade conmonUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeoUpgrade buildah-testsUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade libslirpUpgrade buildahUpgrade runcUpgrade podman-catatonitUpgrade critUpgrade aardvark-dnsUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade criuUpgrade podman-gvproxyUpgrade netavarkUpgrade podman-remoteUpgrade podmanUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade conmon-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade podman-debuginfoUpgrade fuse-overlayfs | Nov 20, 2024 | Oct 15, 2024 |
| Suse | — | Upgrade podman-remoteUpgrade buildahUpgrade skopeo-fish-completionUpgrade podmanshUpgrade skopeoUpgrade skopeo-zsh-completionUpgrade podmanUpgrade podman-dockerUpgrade skopeo-bash-completion | Dec 31, 2024 | Oct 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub