Vulnerability in Containers Common
CVE-2024-9341
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.001
Affected products
- Containers Common
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8 — versions 8100020241023085649.afee755d
- Red Hat Enterprise Linux 9 — versions 4:4.9.4-13.el9_4, 2:1.33.9-1.el9_4, 4:5.2.2-9.el9_5
- Red Hat Openshift Container Platform 4
- Red Hat Openshift Container Platform 4.12 — versions 0:1.25.5-30.rhaos4.12.git53dc492.el8, 0:1.25.5-5.rhaos4.12.git53dc492.el9
- Red Hat Openshift Container Platform 4.13 — versions 0:1.26.5-26.rhaos4.13.giteb3d487.el8
- Red Hat Openshift Container Platform 4.14 — versions 0:1.27.8-10.rhaos4.14.git807f92c.el9, 0:1.27.8-10.rhaos4.14.git807f92c.el8
- Red Hat Openshift Container Platform 4.15 — versions 0:1.28.11-5.rhaos4.15.git35a2431.el8
- Red Hat Openshift Container Platform 4.16 — versions 0:1.29.9-5.rhaos4.16.git34690b9.el8, 416.94.202411201433-0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- access.redhat.com/errata/RHSA-2024:10147 (vendor-advisory)
- access.redhat.com/errata/RHSA-2024:10818 (vendor-advisory)
- access.redhat.com/errata/RHSA-2024:7925 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8039 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8112 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8238 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8263 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8428 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8690 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2024:8694 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-9341?
- CVE-2024-9341 is a medium-severity vulnerability in Containers Common, classified under Improper Link Resolution Before File Access. CVSS score: 5.4/10. Published 2024-10-01.
- How severe is CVE-2024-9341?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2024-9341 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.