Critical Security Update for Podman: Addressing Stack Exhaustion Vulnerabilities
Summary
ALSA-2024:8039: Important: podman security update. Affects podman versions < 4:4.9.4-13.el9_4. Fixed in 4:4.9.4-13.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a powerful tool used for managing pods, container images, and containers, integral to the libpod library and Kubernetes ecosystem. It allows users to run and manage containers without requiring a daemon, offering a lightweight alternative to Docker. The recent vulnerabilities identified in Podman can lead to severe security risks, particularly stack exhaustion, which can crash applications and lead to denial of service.
Vulnerability Detail
The vulnerabilities stem from multiple issues within the Go programming language libraries used by Podman. Specifically, calling certain Parse functions with deeply nested literals can cause a panic or stack exhaustion (CVE-2024-34155). Similarly, using Decoder.Decode on messages with deeply nested structures can also lead to stack exhaustion (CVE-2024-34156). Furthermore, parsing build tag lines with deeply nested expressions can result in a panic (CVE-2024-34158). Additionally, a FIPS Crypto-Policy Directory Mounting Issue in the containers/common Go Library has been identified (CVE-2024-9341). These vulnerabilities could potentially allow attackers to crash the application or exploit the system, leading to unauthorized access or denial of service.
How To Fix
Minimum fixed version
4:4.9.4-13.el9_4
This is the first release that contains the fix.
sudo dnf update podmanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the identified vulnerabilities in Podman pose significant risks that could lead to application crashes and potential exploitation. It is imperative for users to update their Podman installations to the latest patched version to ensure security and stability. Regular monitoring and prompt updates are essential in maintaining a secure environment.
See every vulnerability recorded for podman →
FAQ
Podman is a container management tool that allows users to manage pods, images, and containers without requiring a daemon.
The vulnerabilities include stack exhaustion issues in Go libraries and a FIPS Crypto-Policy Directory Mounting Issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating Podman to mitigate the risks associated with these vulnerabilities.
More details can be found on the CVE pages for CVE-2024-34155, CVE-2024-34156, CVE-2024-34158, and CVE-2024-9341.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
