CVE-2024-3056

What it actually does

Allows a container sharing an IPC namespace to allocate unbounded IPC resources in /dev/shm; the resources persist after the container is OOM-killed because they are bound to the namespace, which is only released when the last container using it exits.

Why it matters to the business

Repeated restarts of the malicious container (via restart policies or attacker control) cause progressive memory exhaustion on the host, resulting in denial of service for other workloads and potential system instability until all containers sharing the namespace are stopped.

How an attack unfolds

An attacker authors a container image that, when started alongside a victim container sharing the same IPC namespace, repeatedly allocates large amounts of shared memory; the container is configured to restart automatically so that each OOM-killed instance leaves behind additional unreclaimed IPC objects until the host runs out of memory.

How to fix it

Upgrade Podman on Debian 13 to version 6.10.4-1 or later; after upgrade, restart all containers that share IPC namespaces and verify that no stale IPC resources remain in affected namespaces.

How to confirm the fix worked

Confirm Podman version is 6.10.4-1 or newer on all hosts; run 'podman version' and package manager queries; test by starting two containers with --ipc=shareable/--ipc=container: and monitoring /dev/shm usage and namespace cleanup on restart.

Typical attack path

1. Identify or create a target container that shares IPC namespace with the victim workload
2. Build and run a malicious container that allocates excessive IPC objects in /dev/shm
3. Configure the malicious container with an automatic restart policy such as --restart=always
4. Trigger repeated OOM kills of the malicious container while a non-malicious container keeps the namespace alive
5. Observe cumulative memory consumption until the host becomes unresponsive

How to detect it

Review Podman and container runtime logs for repeated creation and OOM termination of containers that share IPC namespaces; inspect /proc/sysvipc and /dev/shm for growing numbers of objects tied to long-lived namespaces; correlate with high memory pressure events on the host.

What your security team should do

• Immediately upgrade all Podman installations on Debian 13 to 6.10.4-1
• Audit existing container definitions for use of --ipc=shareable or --ipc=container: combined with restart policies
• Implement resource limits (memory and IPC) on all containers to reduce blast radius
• Monitor container restart counts and /dev/shm usage in orchestration platforms