The Red Hat security advisory RHSA-2024:9051 addresses three vulnerabilities affecting podman, Buildah, and CRI-O components used for container and pod management. CVE-2024-9407 involves improper input validation in the bind-propagation option of the Dockerfile RUN --mount instruction, potentially allowing unexpected behavior during container builds. CVE-2024-9675 allows Buildah to mount arbitrary directories, which could lead to unauthorized access or manipulation of the filesystem. CVE-2024-9676 is a symlink traversal vulnerability in the containers/storage library that can cause denial of service conditions. These vulnerabilities affect Red Hat Enterprise Linux 9 and its variants. Red Hat has issued patches to fix these issues, and users are advised to apply the updates promptly.

These vulnerabilities could allow an attacker with the ability to build or manipulate container images to bypass input validation, mount arbitrary directories, or cause denial of service via symlink traversal. This could lead to unauthorized access to filesystem locations or disruption of container services. However, there are no reports of active exploitation in the wild. The impact is rated as high by Red Hat Product Security.

Red Hat has released an important security update for podman and related packages in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigations are specified or required beyond applying the official patches.