Attacker Value
Unknown
CVE-2024-9676
CVE-2024-9676
(Last updated January 05, 2025) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (--userns=auto in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
6.5 Medium
Impact Score:
3.6
Exploitability Score:
2.8
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High
General Information
Vendors
- redhat
Products
- enterprise linux 9.0,
- enterprise linux eus 9.4,
- enterprise linux for arm 64 9.0 aarch64,
- enterprise linux for arm 64 eus 9.4 aarch64,
- enterprise linux for ibm z systems 9.0 s390x,
- enterprise linux for ibm z systems eus 9.4 s390x,
- enterprise linux for power little endian 9.0 ppc64le,
- enterprise linux for power little endian eus 9.4 ppc64le,
- enterprise linux server aus 9.4,
- enterprise linux server for power little endian update services for sap solutions 9.4 ppc64le,
- openshift container platform 4.12,
- openshift container platform 4.13,
- openshift container platform 4.14,
- openshift container platform 4.15,
- openshift container platform 4.16,
- openshift container platform 4.17,
- openshift container platform for arm64 4.12,
- openshift container platform for arm64 4.13,
- openshift container platform for arm64 4.14,
- openshift container platform for arm64 4.15,
- openshift container platform for arm64 4.16,
- openshift container platform for ibm z 4.12,
- openshift container platform for ibm z 4.13,
- openshift container platform for ibm z 4.14,
- openshift container platform for ibm z 4.15,
- openshift container platform for ibm z 4.16,
- openshift container platform for linuxone 4.12,
- openshift container platform for linuxone 4.13,
- openshift container platform for linuxone 4.14,
- openshift container platform for linuxone 4.15,
- openshift container platform for linuxone 4.16,
- openshift container platform for power 4.12,
- openshift container platform for power 4.13,
- openshift container platform for power 4.14,
- openshift container platform for power 4.15,
- openshift container platform for power 4.16
References
Miscellaneous
