CVE-2024-9676

MediumCVSS 6.5

Published: 15/10/2024(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.34%

71th percentile - higher than 71% of all known CVEs

Summary

A symlink traversal vulnerability in the containers/storage library affects Podman, Buildah, and CRI-O. When running a malicious image with an automatically assigned user namespace (--userns=auto), the library reads /etc/passwd inside the container without validating whether it is a symlink, potentially causing the library to read an arbitrary file on the host and leading to a hang and denial of service via OOM kill.

Risk Assessment

An attacker can cause a denial of service (OOM kill) and read arbitrary host files, potentially exposing sensitive system data.

Recommendation

Update Podman, Buildah, and CRI-O to patched versions and avoid running untrusted images with --userns=auto.

Other vulnerabilities in containers/storage

CVE-2026-79699Medium
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Original NVD description (English source)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS