CVE-2024-9341

MEDIUM

containers/common < 0.60.4 - Symbolic Link Following via FIPS Mode File Path Handling

Title source: llm
STIX 2.1

Description

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

References (17)

Core 17
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:10147
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:10818
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:7925
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8039
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8112
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8238
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8263
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8428
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8690
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8694
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:8846
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:9454
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:9459
Third Party Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2024-9341
Issue Tracking, Third Party Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2315691

Scores

CVSS v3 5.4
EPSS 0.0090
EPSS Percentile 75.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-59
Status published
Products (25)
containers/common
containers/common 0 - 0.60.4Go
Red Hat/Red Hat Enterprise Linux 10
Red Hat/Red Hat Enterprise Linux 8 8100020241023085649.afee755d
Red Hat/Red Hat Enterprise Linux 9 2:1.33.9-1.el9_4
Red Hat/Red Hat Enterprise Linux 9 2:1.37.5-1.el9_5
Red Hat/Red Hat Enterprise Linux 9 4:4.9.4-13.el9_4
Red Hat/Red Hat Enterprise Linux 9 4:5.2.2-9.el9_5
Red Hat/Red Hat OpenShift Container Platform 4
Red Hat/Red Hat OpenShift Container Platform 4.12 0:1.25.5-5.rhaos4.12.git53dc492.el9
... and 15 more
Published Oct 01, 2024
Tracked Since Feb 18, 2026