Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Overview

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

Affected

• openshift-sandboxed-containers/osc-podvm-builder-rhel9 (all versions)
• dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10 (all versions)
• exploit-intelligence/vulnerability-analysis-rhel9 (all versions)
• multicluster-engine/assisted-service-9-rhel9 (all versions)
• multicluster-engine/hive-rhel9 (all versions)
• nvidia/nvidia-jetpack-for-rhel9 (all versions)
• openshift-lightspeed/lightspeed-rhel9-operator (all versions)
• source-to-image/source-to-image-rhel8 (all versions)
• source-to-image/source-to-image-rhel9 (all versions)
• advanced-cluster-security/rhacs-scanner-rhel8 (all versions)
• advanced-cluster-security/rhacs-scanner-rhel9 (all versions)
• advanced-cluster-security/rhacs-scanner-slim-rhel8 (all versions)
• advanced-cluster-security/rhacs-scanner-slim-rhel9 (all versions)
• ansible-automation-platform-26/hub-rhel9 (all versions)
• ansible-automation-platform-27/ansible-devspaces-rhel9 (all versions)
• ansible-automation-platform-27/ansible-dev-tools-rhel9 (all versions)
• ansible-automation-platform-27/hub-rhel9 (all versions)
• ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 (all versions)
• rh-podman-desktop (all versions)
• redhat-certification-preflight (all versions)
• rhdh/rhdh-hub-rhel9 (all versions)
• buildah (all versions)
• oci-seccomp-bpf-hook (all versions)
• podman (all versions)
• rhel10/bootc-image-builder (all versions)
• rhel10-eus/rhel-10.2-bootc (all versions)
• rhel10/rhel-bootc (all versions)
• skopeo (all versions)
• ubi10/buildah (all versions)
• ubi10/skopeo (all versions)
• buildah (all versions)
• oci-seccomp-bpf-hook (all versions)
• podman (all versions)
• rhel9/bootc-image-builder (all versions)
• rhel9-eus/rhel-9.8-bootc (all versions)
• rhel9/rhel-bootc (all versions)
• skopeo (all versions)
• ubi9/buildah (all versions)
• ubi9/skopeo (all versions)
• buildah (all versions)
• containers-common (all versions)
• grype (all versions)
• podman (all versions)
• skopeo (all versions)
• rhoai/odh-ml-pipelines-runtime-generic-rhel9 (all versions)
• rhoai/odh-model-registry-job-async-upload-rhel9 (all versions)
• cri-o (all versions)
• openshift4/kube-compare-artifacts-rhel9 (all versions)
• openshift4/microshift-bootc-rhel10 (all versions)
• openshift4/microshift-bootc-rhel9 (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.