A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade python-podman-apiUpgrade skopeo-testsUpgrade conmonUpgrade containers-commonUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade udicaUpgrade oci-systemd-hookUpgrade podmanUpgrade fuse-overlayfsUpgrade python3-criuUpgrade runcUpgrade criuUpgrade skopeoUpgrade critUpgrade toolboxUpgrade oci-umountUpgrade buildah | May 4, 2022 | Feb 11, 2021 |
| Centos_linux | — | Upgrade criuUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-debugsourceUpgrade skopeoUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade buildah-debuginfoUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade oci-umount-debuginfoUpgrade podman-dockerUpgrade podman-testsUpgrade oci-umountUpgrade podmanUpgrade libslirpUpgrade conmonUpgrade criu-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade udicaUpgrade skopeo-debuginfoUpgrade podman-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade runcUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade container-selinuxUpgrade containers-commonUpgrade runc-debuginfoUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade oci-umount-debugsourceUpgrade libslirp-develUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade critUpgrade oci-systemd-hookUpgrade python-podman-apiUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade criu-debugsource | Feb 16, 2021 | Feb 11, 2021 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Feb 11, 2021 |
| Oracle_linux | — | Upgrade podmanUpgrade skopeoUpgrade containers-commonUpgrade container-selinuxUpgrade skopeo-testsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade criuUpgrade udicaUpgrade podman-testsUpgrade oci-umountUpgrade buildahUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade buildah-testsUpgrade python3-criuUpgrade python-podman-apiUpgrade fuse-overlayfsUpgrade runcUpgrade oci-systemd-hookUpgrade conmonUpgrade podman-dockerUpgrade crit | Mar 6, 2021 | Feb 10, 2021 |
| Redhat_linux | — | Upgrade containers-commonUpgrade libslirp-develUpgrade containernetworking-plugins-debuginfoUpgrade oci-umountUpgrade slirp4netns-debuginfoUpgrade container-selinuxUpgrade containernetworking-plugins-debugsourceUpgrade podmanUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debugsourceUpgrade critUpgrade skopeoUpgrade runc-debuginfoUpgrade toolboxUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade conmonUpgrade podman-remote-debuginfoUpgrade oci-umount-debuginfoUpgrade podman-remoteUpgrade buildah-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade fuse-overlayfsUpgrade criuUpgrade skopeo-debuginfoUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade cockpit-podmanUpgrade udicaUpgrade runc-debugsourceUpgrade runcUpgrade oci-systemd-hookUpgrade libslirp-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade buildah-testsUpgrade libslirpUpgrade criu-debugsourceUpgrade python-podman-apiUpgrade python3-criuUpgrade podman-dockerUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade podman-debuginfoUpgrade buildahUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade oci-umount-debugsourceUpgrade fuse-overlayfs-debugsource | Feb 16, 2021 | Feb 11, 2021 |
| Rocky_linux | — | Upgrade podmanUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade podman-debuginfoUpgrade podman-debugsourceUpgrade criuUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade critUpgrade runcUpgrade oci-systemd-hookUpgrade runc-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-umount-debugsourceUpgrade skopeo-testsUpgrade oci-systemd-hook-debuginfoUpgrade buildah-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debuginfoUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade oci-umountUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade podman-testsUpgrade buildahUpgrade buildah-testsUpgrade containers-commonUpgrade conmon | Mar 12, 2024 | Feb 11, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub