CVE-2024-9676
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 6.5EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
15 out 2024Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
containers/storageRed Hat · OpenShift Developer Tools and ServicesRed Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 4.12Red Hat · Red Hat OpenShift Container Platform 4.13Red Hat · Red Hat OpenShift Container Platform 4.14Red Hat · Red Hat OpenShift Container Platform 4.15Red Hat · Red Hat OpenShift Container Platform 4.16Red Hat · Red Hat OpenShift Container Platform 4.17Red Hat · Red Hat Quay 3Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://access.redhat.com/errata/RHSA-2024:10289https://access.redhat.com/errata/RHSA-2024:8418https://access.redhat.com/errata/RHSA-2024:8428https://access.redhat.com/errata/RHSA-2024:8437https://access.redhat.com/errata/RHSA-2024:8686https://access.redhat.com/errata/RHSA-2024:8690https://access.redhat.com/errata/RHSA-2024:8694https://access.redhat.com/errata/RHSA-2024:8700https://access.redhat.com/errata/RHSA-2024:8984https://access.redhat.com/errata/RHSA-2024:9051https://access.redhat.com/errata/RHSA-2024:9454https://access.redhat.com/errata/RHSA-2024:9459