A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containers-commonUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade podman-dockerUpgrade skopeo-testsUpgrade conmonUpgrade container-selinuxUpgrade python-podman-apiUpgrade podmanUpgrade skopeoUpgrade runcUpgrade critUpgrade oci-umountUpgrade buildahUpgrade toolboxUpgrade udicaUpgrade oci-systemd-hookUpgrade criuUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade python3-criu | May 4, 2022 | Feb 11, 2021 |
| Centos_linux | — | Upgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade buildahUpgrade podmanUpgrade oci-systemd-hook-debuginfoUpgrade criuUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade buildah-debugsourceUpgrade toolboxUpgrade oci-umountUpgrade buildah-debuginfoUpgrade oci-umount-debuginfoUpgrade podman-testsUpgrade criu-debuginfoUpgrade fuse-overlayfsUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade podman-dockerUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-testsUpgrade container-selinuxUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade oci-umount-debugsourceUpgrade runcUpgrade libslirp-debuginfoUpgrade python3-criuUpgrade oci-systemd-hookUpgrade libslirp-debugsourceUpgrade python-podman-apiUpgrade cockpit-podmanUpgrade critUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade containers-commonUpgrade udicaUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade runc-debuginfo | Feb 16, 2021 | Feb 11, 2021 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2021 |
| Oracle_linux | — | Upgrade skopeoUpgrade podmanUpgrade podman-remoteUpgrade container-selinuxUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade buildah-testsUpgrade python3-criuUpgrade podman-testsUpgrade oci-umountUpgrade buildahUpgrade oci-systemd-hookUpgrade conmonUpgrade cockpit-podmanUpgrade critUpgrade runcUpgrade python-podman-apiUpgrade podman-dockerUpgrade slirp4netnsUpgrade criuUpgrade fuse-overlayfsUpgrade udica | Mar 6, 2021 | Feb 10, 2021 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debuginfoUpgrade slirp4netns-debuginfoUpgrade container-selinuxUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade skopeoUpgrade critUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade podmanUpgrade libslirp-develUpgrade containers-commonUpgrade oci-umountUpgrade conmonUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade fuse-overlayfsUpgrade oci-systemd-hookUpgrade python-podman-apiUpgrade udicaUpgrade runcUpgrade runc-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeo-debuginfoUpgrade python3-criuUpgrade oci-systemd-hook-debugsourceUpgrade cockpit-podmanUpgrade criuUpgrade oci-umount-debugsourceUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade buildah-testsUpgrade podman-testsUpgrade podman-debuginfoUpgrade skopeo-debugsourceUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade podman-dockerUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade criu-debuginfo | Feb 16, 2021 | Feb 11, 2021 |
| Rocky_linux | — | Upgrade oci-umount-debuginfoUpgrade criu-debuginfoUpgrade fuse-overlayfsUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade containers-commonUpgrade oci-umountUpgrade slirp4netnsUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade fuse-overlayfs-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade buildah-debuginfoUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade conmonUpgrade buildah-testsUpgrade criu-debugsourceUpgrade critUpgrade podmanUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade criuUpgrade runc-debugsourceUpgrade runcUpgrade oci-systemd-hookUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade skopeo-testsUpgrade python3-criuUpgrade podman-debuginfoUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfo | Mar 12, 2024 | Feb 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub