CVE-2024-9341

Aliases:GHSA-mc76-5925-c5p6GO-2024-3171RHSA-2024:7925RHSA-2024:8238DEBIAN-CVE-2024-9341CGA-7v5x-mh4r-pp3cCGA-98hg-q2rg-7h6rCGA-f78w-q9pq-976qCGA-fcjx-jf52-32rmCGA-g8cv-m843-8rqpCGA-hc28-gfm7-hvxjCGA-344p-7j39-3wmfCGA-563j-f5mm-649wCGA-r2wf-52rc-c899CGA-v77m-6pv6-m683CGA-v9mm-jprv-hm28CGA-x5jx-mf77-p6j8
Advisory lineage Upstream: 0 Downstream: 26
Modified
Published: 01 Oct 2024, 18:52
Last modified:11 Aug 2026, 15:22

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
8.2 HIGH
v3.1 (nvd)
EPSS Score
1.03% LOW
1% probability +0.13%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Oct 2024, 18:52
Published
Vulnerability first disclosed
11 Aug 2026, 15:22
Last Modified
Vulnerability information updated

Description

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
  • v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
  • v3.1•HIGH•Score: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS Trends

Current EPSS score: 1.03%• Percentile: 62%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • chainguard•buildah

    < 1.37.3-r1

  • chainguard•podman

    < 5.4.1-r2

  • chainguard•podman-doc

    < 5.4.1-r2

  • chainguard•skopeo

    < 1.16.1-r2

  • chainguard•skopeo-fips

    < 1.16.1-r2

  • chainguard•zot

    < 2.1.1-r3

  • wolfi•buildah

    < 1.37.3-r1

  • wolfi•podman

    < 5.4.1-r2

  • wolfi•podman-doc

    < 5.4.1-r2

  • wolfi•skopeo

    < 1.16.1-r2

  • wolfi•zot

    < 2.1.1-r3

  • debian•golang-github-containers-common

    all | all | < 0.60.4+ds1-1 | < 0.60.4+ds1-1

  • github.com/containers•common

    < 0.60.4

  • redhat•enterprise_linux

    8.0 | 9.0

  • redhat•openshift_container_platform

    4.12 | 4.13 | 4.14 | 4.15 | 4.16 | 4.17

  • redhat•cri-o

    < 0:1.30.6-3.rhaos4.17.git49b5172.el8 | < 0:1.30.6-3.rhaos4.17.git49b5172.el9 | < 0:1.27.8-10.rhaos4.14.git807f92c.el8 | < 0:1.27.8-10.rhaos4.14.git807f92c.el9

  • redhat•cri-o-debuginfo

    < 0:1.30.6-3.rhaos4.17.git49b5172.el8 | < 0:1.30.6-3.rhaos4.17.git49b5172.el9 | < 0:1.27.8-10.rhaos4.14.git807f92c.el8 | < 0:1.27.8-10.rhaos4.14.git807f92c.el9

  • redhat•cri-o-debugsource

    < 0:1.30.6-3.rhaos4.17.git49b5172.el8 | < 0:1.30.6-3.rhaos4.17.git49b5172.el9 | < 0:1.27.8-10.rhaos4.14.git807f92c.el8 | < 0:1.27.8-10.rhaos4.14.git807f92c.el9

References (30)