A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade runcUpgrade criuUpgrade toolboxUpgrade containernetworking-pluginsUpgrade oci-umountUpgrade fuse-overlayfsUpgrade oci-systemd-hookUpgrade buildahUpgrade podmanUpgrade udicaUpgrade critUpgrade python3-criuUpgrade skopeoUpgrade podman-dockerUpgrade slirp4netnsUpgrade python-podman-apiUpgrade cockpit-podmanUpgrade containers-commonUpgrade skopeo-testsUpgrade conmonUpgrade container-selinux | May 4, 2022 | Feb 11, 2021 |
| Centos_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade buildahUpgrade fuse-overlayfsUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade oci-umount-debuginfoUpgrade oci-umountUpgrade skopeoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade podman-remote-debuginfoUpgrade podmanUpgrade criu-debuginfoUpgrade toolboxUpgrade conmonUpgrade oci-systemd-hook-debugsourceUpgrade libslirpUpgrade podman-testsUpgrade podman-dockerUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade skopeo-debuginfoUpgrade oci-umount-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade libslirp-develUpgrade udicaUpgrade container-selinuxUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade slirp4netns-debuginfoUpgrade runcUpgrade containers-commonUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade python-podman-apiUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade python3-criuUpgrade critUpgrade libslirp-debuginfoUpgrade oci-systemd-hook | Feb 16, 2021 | Feb 11, 2021 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2021 |
| Oracle_linux | — | Upgrade cockpit-podmanUpgrade critUpgrade buildahUpgrade oci-umountUpgrade udicaUpgrade podman-testsUpgrade python-podman-apiUpgrade conmonUpgrade runcUpgrade fuse-overlayfsUpgrade python3-criuUpgrade oci-systemd-hookUpgrade criuUpgrade podman-dockerUpgrade buildah-testsUpgrade slirp4netnsUpgrade skopeo-testsUpgrade skopeoUpgrade podmanUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-remoteUpgrade container-selinux | Mar 6, 2021 | Feb 10, 2021 |
| Redhat_linux | — | Upgrade runc-debugsourceUpgrade podman-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade criu-debuginfoUpgrade udicaUpgrade buildahUpgrade skopeo-debuginfoUpgrade runcUpgrade python-podman-apiUpgrade skopeo-debugsourceUpgrade python3-criuUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade criuUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade libslirp-debuginfoUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade oci-umount-debugsourceUpgrade buildah-testsUpgrade oci-systemd-hookUpgrade podman-testsUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade runc-debuginfoUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade conmonUpgrade libslirp-develUpgrade oci-umount-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolboxUpgrade critUpgrade skopeo-testsUpgrade skopeoUpgrade containers-commonUpgrade containernetworking-plugins-debugsourceUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade container-selinuxUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade oci-umount | Feb 16, 2021 | Feb 11, 2021 |
| Rocky_linux | — | Upgrade oci-umount-debugsourceUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade criuUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade oci-systemd-hookUpgrade runcUpgrade runc-debugsourceUpgrade critUpgrade criu-debugsourceUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade podmanUpgrade python3-criuUpgrade skopeo-testsUpgrade oci-systemd-hook-debuginfoUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade podman-testsUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade conmonUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netnsUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debuginfoUpgrade oci-umountUpgrade skopeoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade oci-umount-debuginfoUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsource | Mar 12, 2024 | Feb 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub