{"id":"CVE-2024-9676","details":"A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.","aliases":["GHSA-wq2p-5pc6-wpgf"],"modified":"2026-04-10T05:19:58.083855Z","published":"2024-10-15T16:15:06.933Z","related":["ALSA-2024:10289","ALSA-2024:9051","ALSA-2024:9454","ALSA-2024:9459","SUSE-SU-2024:3753-1","SUSE-SU-2024:3754-1","SUSE-SU-2024:3988-1","SUSE-SU-2024:4303-1","SUSE-SU-2025:0267-1","SUSE-SU-2025:0775-1","SUSE-SU-2025:20080-1","SUSE-SU-2025:20085-1","openSUSE-SU-2024:14418-1","openSUSE-SU-2024:14420-1","openSUSE-SU-2024:14562-1"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10289"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8428"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8700"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9459"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:0876"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8418"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8437"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9926"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:2454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:2710"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:3301"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wq2p-5pc6-wpgf"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8686"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8690"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8694"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9051"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-9676"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317467"},{"type":"FIX","url":"https://github.com/containers/storage/commit/935c58f4b3e364a9c9d33ed06476a831e6ad5679"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/containers/storage","events":[{"introduced":"0"},{"fixed":"935c58f4b3e364a9c9d33ed06476a831e6ad5679"}]}],"versions":["V1.2","v1","v1.1","v1.11","v1.12.0","v1.12.1","v1.12.2","v1.12.4","v1.12.5","v1.12.9","v1.13.2","v1.15.7","v1.23.0","v1.50.0"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"4.12"}]},{"events":[{"introduced":"0"},{"last_affected":"4.13"}]},{"events":[{"introduced":"0"},{"last_affected":"4.14"}]},{"events":[{"introduced":"0"},{"last_affected":"4.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.16"}]},{"events":[{"introduced":"0"},{"last_affected":"4.17"}]},{"events":[{"introduced":"0"},{"last_affected":"4.12"}]},{"events":[{"introduced":"0"},{"last_affected":"4.13"}]},{"events":[{"introduced":"0"},{"last_affected":"4.14"}]},{"events":[{"introduced":"0"},{"last_affected":"4.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.16"}]},{"events":[{"introduced":"0"},{"last_affected":"4.12"}]},{"events":[{"introduced":"0"},{"last_affected":"4.13"}]},{"events":[{"introduced":"0"},{"last_affected":"4.14"}]},{"events":[{"introduced":"0"},{"last_affected":"4.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.16"}]},{"events":[{"introduced":"0"},{"last_affected":"4.12"}]},{"events":[{"introduced":"0"},{"last_affected":"4.13"}]},{"events":[{"introduced":"0"},{"last_affected":"4.14"}]},{"events":[{"introduced":"0"},{"last_affected":"4.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.16"}]},{"events":[{"introduced":"0"},{"last_affected":"4.12"}]},{"events":[{"introduced":"0"},{"last_affected":"4.13"}]},{"events":[{"introduced":"0"},{"last_affected":"4.14"}]},{"events":[{"introduced":"0"},{"last_affected":"4.15"}]},{"events":[{"introduced":"0"},{"last_affected":"4.16"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0_aarch64"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4_aarch64"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0_s390x"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4_s390x"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0_ppc64le"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4_ppc64le"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4_ppc64le"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9676.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}