A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade udicaUpgrade crunUpgrade python3-podmanUpgrade netavarkUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade criuUpgrade skopeoUpgrade critUpgrade podman-catatonitUpgrade toolboxUpgrade toolbox-testsUpgrade podmanUpgrade fuse-overlayfsUpgrade runcUpgrade buildahUpgrade libslirp-develUpgrade containers-commonUpgrade container-selinuxUpgrade libslirpUpgrade podman-testsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade criu-develUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade conmonUpgrade python3-criuUpgrade cockpit-podmanUpgrade podman-dockerUpgrade aardvark-dnsUpgrade slirp4netns | Nov 12, 2024 | Oct 15, 2024 |
| Alpine Linux | — | Upgrade podmanUpgrade buildah | Aug 8, 2025 | Oct 15, 2024 |
| Debian | — | Upgrade golang-github-containers-storage | May 15, 2025 | Oct 15, 2024 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade containers-commonUpgrade skopeoUpgrade podmanUpgrade podman-pluginsUpgrade criu-develUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade container-selinuxUpgrade crunUpgrade python3-criuUpgrade criu-libsUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade buildahUpgrade netavarkUpgrade conmonUpgrade podman-testsUpgrade runcUpgrade podman-catatonitUpgrade podman-dockerUpgrade criuUpgrade aardvark-dnsUpgrade libslirpUpgrade buildah-testsUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade udicaUpgrade critUpgrade podman-gvproxy | Nov 21, 2024 | Oct 15, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade podman | Oct 30, 2024 | Oct 15, 2024 |
| Redhat_linux | — | Upgrade podman-testsUpgrade toolbox-debugsourceUpgrade buildah-tests-debuginfoUpgrade criu-debugsourceUpgrade netavarkUpgrade python3-podmanUpgrade udicaUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade podmanUpgrade buildah-testsUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade skopeoUpgrade conmon-debuginfoUpgrade buildah-debuginfoUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade libslirpUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade toolbox-testsUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade podman-gvproxyNo solution existsUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade python3-criuUpgrade podman-debuginfoUpgrade crun-debugsourceUpgrade critUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-plugins-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade podman-catatonit-debuginfoUpgrade toolboxUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade containers-commonUpgrade libslirp-develUpgrade toolbox-debuginfoUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade container-selinuxUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade conmonUpgrade buildah-debugsourceUpgrade criu-libsUpgrade skopeo-tests | Nov 13, 2024 | Oct 15, 2024 |
| Rocky_linux | — | Upgrade toolbox-testsUpgrade criu-libs-debuginfoUpgrade netavarkUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade buildah-debuginfoUpgrade aardvark-dnsUpgrade runcUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade criu-debuginfoUpgrade critUpgrade slirp4netnsUpgrade buildah-testsUpgrade podman-catatonitUpgrade criuUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade libslirpUpgrade podmanUpgrade podman-remoteUpgrade podman-gvproxyUpgrade podman-testsUpgrade runc-debugsourceUpgrade crunUpgrade criu-develUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade libslirp-debugsourceUpgrade python3-criuUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade podman-pluginsUpgrade criu-libsUpgrade containers-commonUpgrade conmonUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade skopeo-testsUpgrade skopeo | Nov 20, 2024 | Oct 15, 2024 |
| Suse | — | Upgrade skopeoUpgrade podman-dockerUpgrade skopeo-bash-completionUpgrade skopeo-zsh-completionUpgrade podmanUpgrade skopeo-fish-completionUpgrade podman-remoteUpgrade buildahUpgrade podmansh | Dec 31, 2024 | Oct 15, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Oct 15, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub