CVE-2024-9341: Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
A flaw in the containers/common Go library, used by container runtimes such as Podman, Buildah, and CRI-O, allows a malicious container image to exploit the FIPS mode to bind mount arbitrary host directories into the container. The flaw arises from the MountsWithUIDGID() function, which attempts to mount a FIPS-related directory inside the container but does not properly verify the path. If the FIPS path is a symlink, it could point to arbitrary directories on the host, allowing an attacker to access sensitive host files.
Other sources
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
— GitHub
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9341?
CVE-2024-9341 has been assigned a critical severity due to its potential for exploitation in container environments.
How can I mitigate CVE-2024-9341?
To mitigate CVE-2024-9341, it is recommended to upgrade to the remedy version 0.60.4 of the containers/common Go library.
Which affected software versions are vulnerable to CVE-2024-9341?
Vulnerable software versions for CVE-2024-9341 include specific versions of Red Hat OpenShift Container Platform from 4.12 to 4.17 and Red Hat Enterprise Linux 8.0 and 9.0.
What impact does CVE-2024-9341 have on container security?
CVE-2024-9341 could allow a malicious container to bind mount arbitrary host directories, compromising the host system's integrity.
Is there a workaround for CVE-2024-9341 before applying the fix?
No specific workarounds have been recommended for CVE-2024-9341, so applying the fix is critical.