A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and potentially be DoSed via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host. This file is only read, and if it does not properly parse as a copy of `/etc/passwd` it will cause an error (there is a small risk of information disclosure via the error message here as elements of the file that failed to parse can be included, but this is only as the user running Podman/Buildah/CRI-O so it wouldn't be a file they did not already have access to). The report here discovered that you can symlink /etc/passwd in the container to a FIFO on the host, causing a hang as the file cannot be completely read (or an OOM condition if the FIFO is continuously written to, which was then ready by Podman). This hang could occur in a critical section in the c/storage library, blocking other processes from creating containers, but could be easily solved via a SIGKILL of the affected process. The ability to potentially crash the CRI-O service via OOM kill could be more relevant, though the attacker would have to know the path of a FIFO that is regularly being written to on the host in order to do this.
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:8437 https://access.redhat.com/errata/RHSA-2024:8437
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:8418 https://access.redhat.com/errata/RHSA-2024:8418
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:8428 https://access.redhat.com/errata/RHSA-2024:8428
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:8686 https://access.redhat.com/errata/RHSA-2024:8686
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:8690 https://access.redhat.com/errata/RHSA-2024:8690
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Ironic content for Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:8694 https://access.redhat.com/errata/RHSA-2024:8694
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:8700 https://access.redhat.com/errata/RHSA-2024:8700
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9051 https://access.redhat.com/errata/RHSA-2024:9051
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9454 https://access.redhat.com/errata/RHSA-2024:9454
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9459 https://access.redhat.com/errata/RHSA-2024:9459
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:8984 https://access.redhat.com/errata/RHSA-2024:8984
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2024:9926 https://access.redhat.com/errata/RHSA-2024:9926
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:10289 https://access.redhat.com/errata/RHSA-2024:10289
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:0876 https://access.redhat.com/errata/RHSA-2025:0876
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2025:2454 https://access.redhat.com/errata/RHSA-2025:2454
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2025:2710 https://access.redhat.com/errata/RHSA-2025:2710
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:3301 https://access.redhat.com/errata/RHSA-2025:3301