A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade udicaUpgrade runcUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade critUpgrade buildahUpgrade fuse-overlayfsUpgrade criuUpgrade skopeoUpgrade oci-systemd-hookUpgrade toolboxUpgrade podmanUpgrade oci-umountUpgrade python-podman-apiUpgrade slirp4netnsUpgrade podman-dockerUpgrade conmonUpgrade container-selinuxUpgrade containers-commonUpgrade cockpit-podmanUpgrade skopeo-tests | May 4, 2022 | Feb 11, 2021 |
| Centos_linux | — | Upgrade libslirpUpgrade buildahUpgrade toolboxUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade fuse-overlayfsUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade oci-umount-debuginfoUpgrade oci-umountUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade podmanUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-debuginfoUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade containers-commonUpgrade oci-systemd-hookUpgrade libslirp-debuginfoUpgrade python-podman-apiUpgrade container-selinuxUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade udicaUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-develUpgrade oci-umount-debugsourceUpgrade critUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade cockpit-podmanUpgrade runcUpgrade runc-debugsourceUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade skopeo-tests | Feb 16, 2021 | Feb 11, 2021 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2021 |
| Oracle_linux | — | Upgrade podmanUpgrade skopeoUpgrade containers-commonUpgrade container-selinuxUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade oci-systemd-hookUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade critUpgrade conmonUpgrade oci-umountUpgrade buildahUpgrade udicaUpgrade cockpit-podmanUpgrade python3-criuUpgrade criuUpgrade python-podman-apiUpgrade runcUpgrade slirp4netnsUpgrade podman-tests | Mar 6, 2021 | Feb 10, 2021 |
| Redhat_linux | — | Upgrade buildah-testsUpgrade oci-systemd-hookUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade python-podman-apiUpgrade runc-debugsourceUpgrade runcUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade slirp4netnsUpgrade udicaUpgrade cockpit-podmanUpgrade oci-systemd-hook-debugsourceUpgrade buildah-debuginfoUpgrade oci-umount-debugsourceUpgrade criuUpgrade skopeo-debuginfoUpgrade python3-criuUpgrade buildahUpgrade oci-systemd-hook-debuginfoUpgrade libslirpUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-testsUpgrade podman-dockerUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade oci-umount-debuginfoUpgrade oci-umountUpgrade skopeo-testsUpgrade podman-remoteUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade buildah-debugsourceUpgrade conmonUpgrade critUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade toolboxUpgrade libslirp-debugsource | Feb 16, 2021 | Feb 11, 2021 |
| Rocky_linux | — | Upgrade criu-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade podman-debuginfoUpgrade python3-criuUpgrade oci-umount-debugsourceUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade podman-remoteUpgrade podmanUpgrade podman-debugsourceUpgrade criuUpgrade runcUpgrade runc-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade critUpgrade skopeo-testsUpgrade oci-systemd-hookUpgrade fuse-overlayfs-debuginfoUpgrade oci-umountUpgrade oci-systemd-hook-debugsourceUpgrade podman-testsUpgrade skopeoUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade buildah-testsUpgrade runc-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade slirp4netnsUpgrade criu-debuginfoUpgrade oci-umount-debuginfoUpgrade fuse-overlayfsUpgrade conmonUpgrade buildah | Mar 12, 2024 | Feb 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub