A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade conmonUpgrade containers-commonUpgrade podman-dockerUpgrade cockpit-podmanUpgrade python-podman-apiUpgrade container-selinuxUpgrade skopeo-testsUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade critUpgrade python3-criuUpgrade fuse-overlayfsUpgrade runcUpgrade skopeoUpgrade oci-systemd-hookUpgrade buildahUpgrade oci-umountUpgrade criuUpgrade toolboxUpgrade udicaUpgrade podman | May 4, 2022 | Feb 11, 2021 |
| Centos_linux | — | Upgrade oci-umount-debuginfoUpgrade oci-umountUpgrade fuse-overlayfsUpgrade podman-testsUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade oci-systemd-hook-debugsourceUpgrade buildahUpgrade libslirpUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade buildah-debugsourceUpgrade toolboxUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade podmanUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade critUpgrade podman-remoteUpgrade criu-debugsourceUpgrade runc-debuginfoUpgrade slirp4netnsUpgrade oci-systemd-hookUpgrade container-selinuxUpgrade containers-commonUpgrade python-podman-apiUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade cockpit-podmanUpgrade skopeo-debuginfoUpgrade runcUpgrade libslirp-debugsourceUpgrade udicaUpgrade libslirp-develUpgrade oci-umount-debugsourceUpgrade containernetworking-plugins | Feb 16, 2021 | Feb 11, 2021 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2021 |
| Oracle_linux | — | Upgrade conmonUpgrade oci-systemd-hookUpgrade fuse-overlayfsUpgrade python-podman-apiUpgrade runcUpgrade buildah-testsUpgrade slirp4netnsUpgrade buildahUpgrade cockpit-podmanUpgrade criuUpgrade python3-criuUpgrade critUpgrade podman-dockerUpgrade udicaUpgrade oci-umountUpgrade podman-testsUpgrade podmanUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-remoteUpgrade skopeo-testsUpgrade container-selinuxUpgrade skopeo | Mar 6, 2021 | Feb 10, 2021 |
| Redhat_linux | — | Upgrade podman-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade runc-debugsourceUpgrade skopeo-debugsourceUpgrade buildahUpgrade libslirp-debuginfoUpgrade libslirpUpgrade udicaUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade criuUpgrade buildah-testsUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade runcUpgrade cockpit-podmanUpgrade skopeo-debuginfoUpgrade criu-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade oci-umount-debugsourceUpgrade oci-systemd-hookUpgrade python-podman-apiUpgrade python3-criuUpgrade podman-testsUpgrade oci-umountUpgrade skopeo-testsUpgrade podman-remoteUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade skopeoUpgrade critUpgrade buildah-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade podmanUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade libslirp-develUpgrade conmonUpgrade containers-commonUpgrade oci-umount-debuginfoUpgrade container-selinuxUpgrade libslirp-debugsource | Feb 16, 2021 | Feb 11, 2021 |
| Rocky_linux | — | Upgrade buildahUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade skopeoUpgrade conmonUpgrade oci-umountUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade containers-commonUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-testsUpgrade oci-umount-debuginfoUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade podmanUpgrade criuUpgrade runcUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade critUpgrade slirp4netns-debugsourceUpgrade oci-umount-debugsourceUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hookUpgrade runc-debugsourceUpgrade python3-criuUpgrade podman-debuginfoUpgrade skopeo-tests | Mar 12, 2024 | Feb 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub