The Container Network Interface (CNI) project provides specifications and libraries for configuring network interfaces in Linux containers. Two vulnerabilities have been identified and fixed in the containernetworking-plugins package for Red Hat Enterprise Linux 9. CVE-2024-24788 involves a malformed DNS message in the golang net package that can cause an infinite loop, potentially impacting container network operations. CVE-2024-24791 is a denial of service vulnerability caused by improper handling of HTTP 100-continue requests in the net/http package. Red Hat has released an updated package to address these issues as part of the Red Hat Enterprise Linux 9.5 update. The advisory rates the security impact as moderate and provides detailed instructions for applying the update.

The vulnerabilities can cause denial of service conditions in container networking environments by triggering infinite loops or improper HTTP request handling. This may disrupt network connectivity for containers managed by the containernetworking-plugins package. No known exploits in the wild have been reported. The impact is limited to network interface configuration and resource cleanup in Linux containers.

Red Hat has released an official security update for containernetworking-plugins in Red Hat Enterprise Linux 9. Users should apply the update as described in the Red Hat advisory RHSA-2024:9089 and the linked article https://access.redhat.com/articles/11258. This update addresses both CVE-2024-24788 and CVE-2024-24791. No additional mitigation steps are required beyond applying the official patch.