CVE-2024-9676

Executive Summary

CVE-2024-9676 is a denial-of-service (DoS) vulnerability affecting Podman, Buildah, and CRI-O, which are container management tools widely used in Red Hat and other Linux environments. The flaw resides in the underlying containers/storage library, which fails to properly validate whether /etc/passwd inside a container image is a symlink. When a user runs a malicious container image with the --userns=auto flag (which automatically assigns a user namespace), the library reads /etc/passwd from the container. If that file is a symlink pointing to a large or infinite file on the host (e.g., /dev/zero or a FIFO), the read operation can cause the process to hang and eventually be killed by the Out-Of-Memory (OOM) killer, resulting in a denial of service.

This vulnerability is particularly dangerous in multi-tenant environments where users can run arbitrary container images, as it allows a low-privileged attacker to crash the container runtime or the host system. The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is medium (6.2) due to the local attack vector and high availability impact.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a system-level library (containers/storage) used by container runtimes. However, it affects the supply chain of container images: a malicious image can be crafted and distributed via container registries (e.g., Docker Hub, Quay.io). Users who pull and run such images with --userns=auto are vulnerable. The fix is in the library, so all downstream tools (Podman, Buildah, CRI-O) must be updated to a version that includes the patched library.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must be able to run a container on the host.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond running a malicious image.
• Privileges Required (PR): None (N) – The attacker does not need any privileges on the host.
• User Interaction (UI): Required (R) – The victim (or automated system) must run the malicious image.
• Scope (S): Unchanged (U) – The impact is confined to the host's availability.
• Confidentiality (C): None (N) – No data is leaked.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The host or container runtime can be made unavailable.

CVSS Base Score: 6.2 (Medium)

Threat Level: Medium. The vulnerability requires local access to run a container, but in multi-tenant environments (e.g., CI/CD pipelines, shared hosting), this is easily exploitable. The impact is a denial of service, which can disrupt operations.

Deep Dive & Mechanics

The vulnerability is in the containers/storage library, which is used by Podman, Buildah, and CRI-O to manage container images and storage. When a container is run with --userns=auto, the library automatically creates a user namespace and maps user IDs. As part of this process, it reads /etc/passwd from the container image to determine the user mapping.

The bug is that the library does not check whether /etc/passwd is a symlink before reading it. An attacker can craft a container image where /etc/passwd is a symlink pointing to a file on the host that causes the read operation to hang or consume excessive memory. For example:

• Symlink to /dev/zero: Reading from /dev/zero returns an infinite stream of null bytes, causing the library to hang indefinitely.
• Symlink to a FIFO (named pipe): Reading from a FIFO blocks until data is written, causing a hang.
• Symlink to a large file (e.g., /proc/kcore): Reading a huge file can exhaust memory and trigger OOM.

The attack flow:

1. Attacker creates a container image with /etc/passwd as a symlink to a problematic host file.
2. Attacker pushes the image to a public registry.
3. Victim runs the image with podman run --userns=auto malicious-image or similar.
4. The containers/storage library reads the symlinked /etc/passwd, causing a hang or OOM.
5. The container runtime (Podman, Buildah, CRI-O) becomes unresponsive, and the host may crash due to OOM.

Vulnerable vs. Patched Code

Vulnerable Code (containers/storage < 1.54.0): The library reads /etc/passwd without checking if it is a symlink. Pseudocode:

func readPasswd(containerRoot string) ([]byte, error) {
    passwdPath := filepath.Join(containerRoot, "etc", "passwd")
    data, err := ioutil.ReadFile(passwdPath) // No symlink check
    if err != nil {
        return nil, err
    }
    return data, nil
}

Patched Code (containers/storage >= 1.54.0): The library now uses os.Lstat to check if the file is a symlink before reading. If it is a symlink, it returns an error. Pseudocode:

func readPasswd(containerRoot string) ([]byte, error) {
    passwdPath := filepath.Join(containerRoot, "etc", "passwd")
    fi, err := os.Lstat(passwdPath)
    if err != nil {
        return nil, err
    }
    if fi.Mode()&os.ModeSymlink != 0 {
        return nil, fmt.Errorf("refusing to read symlink: %s", passwdPath)
    }
    data, err := ioutil.ReadFile(passwdPath)
    if err != nil {
        return nil, err
    }
    return data, nil
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Linux host with Podman, Buildah, or CRI-O installed.
• Ability to build and push a container image.

Steps:

1. Create a malicious container image with a symlink for /etc/passwd:

   FROM scratch
   RUN ln -s /dev/zero /etc/passwd
   

   (Note: FROM scratch is minimal; you can also use a base image like alpine.)

2. Build and push the image:

   podman build -t malicious-image .
   podman push malicious-image docker.io/attacker/malicious-image
   

3. On the target host, run the image with --userns=auto:

   podman run --userns=auto docker.io/attacker/malicious-image
   

4. Observe the hang. The Podman process will consume CPU/memory until OOM.

Alternative payloads:

• Symlink to /proc/self/fd/0 (stdin) to cause a hang.
• Symlink to a FIFO created in the image.

Blue Team (Defense & Detection)

Detection:

• Monitor for processes reading /dev/zero, /proc/kcore, or other sensitive files from within containers.
• Use auditd to log symlink traversal attempts:

  auditctl -a always,exit -S symlink -F key=symlink_traversal
  

• Check for containers running with --userns=auto and inspect their images for symlinks.

Prevention:

• Update to containers/storage >= 1.54.0.
• Disable --userns=auto if not needed.
• Use image scanning tools (e.g., Trivy, Clair) to detect symlinks in /etc/passwd.
• Apply SELinux or AppArmor policies to restrict symlink following.

Indicators of Compromise (IOCs)

• File System: Container images where /etc/passwd is a symlink.
• Process: Podman, Buildah, or CRI-O processes hanging or consuming excessive memory.
• Logs: OOM killer messages in dmesg or /var/log/syslog related to container runtimes.
• Network: Unusual outbound connections from container runtimes (if the image is pulled from a malicious registry).
• Auditd: Events with key symlink_traversal or SYS_SYMLINK from container processes.

Detection Engineering

YARA Rule

rule CVE_2024_9676_Symlink_Passwd {
    meta:
        description = "Detects container images where /etc/passwd is a symlink"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-9676"
    strings:
        $symlink = "/etc/passwd" nocase
        $link_target = "/dev/zero" or "/proc/" or "/sys/"
    condition:
        $symlink and $link_target
}

Sigma Rule

title: CVE-2024-9676 - Symlink Traversal in containers/storage
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to read /etc/passwd as a symlink from within a container
logsource:
    product: linux
    service: auditd
detection:
    selection:
        syscall: symlink
        key: symlink_traversal
    condition: selection
falsepositives:
    - Legitimate use of symlinks in container images (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-9676 - Potential Symlink Traversal in Container Image"; content:"/etc/passwd"; content:"/dev/zero"; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update containers/storage to version 1.54.0 or later.
• Update Podman, Buildah, and CRI-O to versions that include the patched library.
• If immediate patching is not possible, disable --userns=auto in Podman and Buildah configurations.

Long-term:

• Implement image scanning in CI/CD pipelines to detect symlinks in critical files.
• Use container runtime security features (e.g., seccomp, AppArmor) to restrict syscalls like symlink.
• Monitor for OOM events and investigate container runtimes.

Workaround:

• Avoid running untrusted images with --userns=auto.
• Use --userns=keep-id or manual user namespace mapping instead.

Valters IT
DevSecOps & Cyber Threat Intelligence