CVE-2024-9676 Path traversal in OpenShift Developer Tools and Services
A symlink traversal flaw in containers/storage allows malicious images to cause denial of service and read arbitrary host files when using auto user namespaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9676?
CVE-2024-9676 is a medium-severity path traversal vulnerability in Redhat Enterprise Linux, published on 15 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
Weakness: CWE-22
Which versions are affected by CVE-2024-9676?
It affects 15 products.
Linux distribution packages (20)
cri-o Red Hat:openshift:4.17::el8 | All versions | 0:1.30.6-6.rhaos4.17.git6ac6e96.el8 |
cri-o-debuginfo Red Hat:openshift:4.17::el8 | All versions | 0:1.30.6-6.rhaos4.17.git6ac6e96.el8 |
cri-o-debugsource Red Hat:openshift:4.17::el8 | All versions | 0:1.30.6-6.rhaos4.17.git6ac6e96.el8 |
cri-o Red Hat:openshift:4.17::el9 | All versions | 0:1.30.6-6.rhaos4.17.git6ac6e96.el9 |
cri-o-debuginfo Red Hat:openshift:4.17::el9 | All versions | 0:1.30.6-6.rhaos4.17.git6ac6e96.el9 |
cri-o-debugsource Red Hat:openshift:4.17::el9 | All versions | 0:1.30.6-6.rhaos4.17.git6ac6e96.el9 |
podman SUSE:Linux Enterprise Micro 5.5 | All versions | 4.9.5-150500.3.28.1 |
buildah SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.35.4-150500.3.19.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 4.9.5-150500.3.28.1 |
buildah SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 1.35.4-150500.3.19.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 4.9.5-150500.3.28.1 |
skopeo SUSE:Linux Micro 6.0 | All versions | 1.14.4-2.1 |
buildah openSUSE:Leap 15.5 | All versions | 1.35.4-150500.3.19.1 |
podman openSUSE:Leap 15.5 | All versions | 4.9.5-150500.3.28.1 |
buildah openSUSE:Leap 15.6 | All versions | 1.35.4-150500.3.19.1 |
podman openSUSE:Leap 15.6 | All versions | 4.9.5-150500.3.28.1 |
podman openSUSE:Leap Micro 5.5 | All versions | 4.9.5-150500.3.28.1 |
buildah openSUSE:Tumbleweed | All versions | 1.37.5-1.1 |
podman openSUSE:Tumbleweed | All versions | 5.2.4-3.1 |
skopeo openSUSE:Tumbleweed | All versions | 1.16.1-2.1 |
Products include Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Arm 64 Eus, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Ibm Z Systems Eus and 9 more.
How do I fix CVE-2024-9676?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-9676 being exploited?
There is no known exploitation of CVE-2024-9676 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
Sources
Also known as AZL-50598, AZL-50601, AZL-50609, AZL-50612, AZL-50614, AZL-50620 and 19 more.