PT-2024-8229 · Podman+1 · Podman+1
Robb Gatica
·
Published
2024-03-21
·
Updated
2024-12-27
·
CVE-2024-3056
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Podman (affected versions not specified)
Description:
A flaw in Podman may allow an attacker to create a specially crafted container that can exhaust resources in /dev/shm by creating a large number of IPC resources. This can lead to a memory-based denial of service of the system, especially when a container is configured to restart always, such as with
podman run --restart=always. The issue arises because the IPC resources created by the malicious container are not removed even after the container is out-of-memory (OOM) killed, as they are tied to an IPC namespace that remains open until all using containers are stopped.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Podman