A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cockpit-podmanUpgrade criu-develUpgrade podman-testsUpgrade libslirpUpgrade libslirp-develUpgrade podman-gvproxyUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade container-selinuxUpgrade slirp4netnsUpgrade criu-libsUpgrade skopeo-testsUpgrade python3-criuUpgrade podman-dockerUpgrade buildah-testsUpgrade aardvark-dnsUpgrade conmonUpgrade podman-pluginsUpgrade crunUpgrade toolboxUpgrade python3-podmanUpgrade podman-remoteUpgrade criuUpgrade podman-catatonitUpgrade critUpgrade udicaUpgrade containernetworking-pluginsUpgrade podmanUpgrade buildahUpgrade toolbox-testsUpgrade netavarkUpgrade skopeoUpgrade runcUpgrade fuse-overlayfs | Nov 12, 2024 | Oct 15, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Oct 15, 2024 |
| Debian | — | No solution existsUpgrade golang-github-containers-storage | May 15, 2025 | Oct 15, 2024 |
| Oracle_linux | — | Upgrade slirp4netnsUpgrade podman-testsUpgrade critUpgrade netavarkUpgrade podman-gvproxyUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade buildahUpgrade criuUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade conmonUpgrade libslirpUpgrade runcUpgrade buildah-testsUpgrade udicaUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade container-selinuxUpgrade skopeo-testsUpgrade podman-remoteUpgrade crunUpgrade skopeoUpgrade containers-commonUpgrade podmanUpgrade libslirp-develUpgrade python3-criuUpgrade criu-develUpgrade containernetworking-pluginsUpgrade python3-podman | Nov 21, 2024 | Oct 15, 2024 |
| Redhat Openshift | — | Upgrade podmanUpgrade cri-o | Oct 30, 2024 | Oct 15, 2024 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade podmanUpgrade conmon-debuginfoUpgrade toolbox-testsUpgrade podman-testsUpgrade python3-podmanUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade netavarkUpgrade udicaUpgrade criu-libs-debuginfoUpgrade conmon-debugsourceUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade buildah-testsUpgrade runc-debugsourceUpgrade libslirpUpgrade criuUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debugsourceNo solution existsUpgrade slirp4netnsUpgrade skopeoUpgrade podman-dockerUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-remote-debuginfoUpgrade critUpgrade crun-debugsourceUpgrade podman-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debuginfoUpgrade python3-criuUpgrade criu-libsUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade skopeo-testsUpgrade container-selinuxUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade toolboxUpgrade criu-develUpgrade runc-debuginfoUpgrade crunUpgrade podman-remote | Nov 13, 2024 | Oct 15, 2024 |
| Rocky_linux | — | Upgrade slirp4netnsUpgrade podmanUpgrade podman-testsUpgrade toolbox-testsUpgrade criu-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade criu-debugsourceUpgrade toolbox-debugsourceUpgrade conmon-debuginfoUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade podman-debuginfoUpgrade runc-debugsourceUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade conmon-debugsourceUpgrade criuUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade podman-remoteUpgrade netavarkUpgrade fuse-overlayfsUpgrade buildahUpgrade critUpgrade runcUpgrade podman-catatonit-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-debuginfoUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade conmonUpgrade containers-commonUpgrade criu-libsUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade criu-develUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsource | Nov 20, 2024 | Oct 15, 2024 |
| Suse | — | Upgrade skopeoUpgrade skopeo-bash-completionUpgrade podmanUpgrade skopeo-zsh-completionUpgrade podman-dockerUpgrade skopeo-fish-completionUpgrade podmanshUpgrade podman-remoteUpgrade buildah | Dec 31, 2024 | Oct 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub