CVE-2024-9341
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
MEDIUM 5.4
At a glance
- Source
- NVD
- EPSS
- EPSS 1.03 % · percentile 64 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
Weaknesses (CWE)
- CWE-59 — Link Following
References
- https://access.redhat.com/errata/RHSA-2024:10147
- https://access.redhat.com/errata/RHSA-2024:10818
- https://access.redhat.com/errata/RHSA-2024:6122
- https://access.redhat.com/errata/RHSA-2024:7925
- https://access.redhat.com/errata/RHSA-2024:8039
- https://access.redhat.com/errata/RHSA-2024:8112
- https://access.redhat.com/errata/RHSA-2024:8238
- https://access.redhat.com/errata/RHSA-2024:8263
- https://access.redhat.com/errata/RHSA-2024:8428
- https://access.redhat.com/errata/RHSA-2024:8690
- https://access.redhat.com/errata/RHSA-2024:8694
- https://access.redhat.com/errata/RHSA-2024:8846
- https://access.redhat.com/errata/RHSA-2024:9454
- https://access.redhat.com/errata/RHSA-2024:9459
- https://access.redhat.com/security/cve/CVE-2024-9341
- https://bugzilla.redhat.com/show_bug.cgi?id=2315691
- https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169
- https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-mc76-5925-c5p6 — Link Following in github.com/containers/common
- GO-2024-3171 — Link Following in github.com/containers/common
European references
- ENISA EUVD · EUVD-2024-3079
- GCVE · GCVE-0-2024-9341
Affected configurations (NVD CPE)
cpe:2.3:a:containers:common:*:*:*:*:*:go:*:*cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.15:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.16:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.17:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| github.com/containers/common | affected 0 < 0.60.4 |
| Red Hat · Red Hat Enterprise Linux 8 | unaffected 8100020241023085649.afee755d < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 4:4.9.4-13.el9_4 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 2:1.33.9-1.el9_4 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 4:5.2.2-9.el9_5 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 2:1.37.5-1.el9_5 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.12 | unaffected 0:1.25.5-30.rhaos4.12.git53dc492.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.13 | unaffected 0:1.26.5-26.rhaos4.13.giteb3d487.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected 0:1.27.8-10.rhaos4.14.git807f92c.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.15 | unaffected 0:1.28.11-5.rhaos4.15.git35a2431.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.16 | unaffected 0:1.29.9-5.rhaos4.16.git34690b9.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.16 | unaffected 416.94.202411201433-0 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.17 | unaffected 0:1.30.6-3.rhaos4.17.git49b5172.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.17 | unaffected 417.94.202412040832-0 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |