Home

CVE-2021-20188

Description

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Risk Information

Base Score
7.0
MODERATE
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.085

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2021:0681) podman security update podman-1.6.4-29.el7_9.x86_64.rpmLinux
(RHSA-2021:0681) podman security update podman-docker-1.6.4-29.el7_9.noarch.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update buildah-1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update buildah-debugsource-1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update container-selinux-2.124.0-1.gitf958d0c.module+el8.3.0+10171+12421f43.noarch.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update containernetworking-plugins-0.7.4-4.git9ebe139.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update containernetworking-plugins-debugsource-0.7.4-4.git9ebe139.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update containers-common-0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update crit-3.12-9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update criu-3.12-9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update criu-debugsource-3.12-9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update fuse-overlayfs-0.3-5.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update fuse-overlayfs-debugsource-0.3-5.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update oci-umount-2.3.4-2.git87f9237.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update podman-1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update podman-debugsource-1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update podman-docker-1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43.noarch.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update python3-criu-3.12-9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update runc-1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update skopeo-0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update skopeo-debugsource-0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705) container-tools:1.0 security update slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update buildah-debugsource-1.11.6-8.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update buildah-tests-1.11.6-8.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update cockpit-podman-11-1.module+el8.3.0+10188+4c10031c.noarch.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update conmon-2.0.15-1.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update container-selinux-2.130.0-1.module+el8.3.0+10188+4c10031c.noarch.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update containernetworking-plugins-0.8.3-4.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update containernetworking-plugins-debugsource-0.8.3-4.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update containers-common-0.1.41-4.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update crit-3.12-9.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update criu-3.12-9.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update criu-debugsource-3.12-9.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update fuse-overlayfs-0.7.8-1.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update fuse-overlayfs-debugsource-0.7.8-1.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update podman-1.6.4-26.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update podman-debugsource-1.6.4-26.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update podman-docker-1.6.4-26.module+el8.3.0+10188+4c10031c.noarch.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update podman-remote-1.6.4-26.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update podman-tests-1.6.4-26.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.3.0+10188+4c10031c.noarch.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update python3-criu-3.12-9.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update runc-1.0.0-64.rc10.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update runc-debugsource-1.0.0-64.rc10.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update skopeo-0.1.41-4.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update skopeo-debugsource-0.1.41-4.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update skopeo-tests-0.1.41-4.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update slirp4netns-0.4.2-3.git21fdece.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.3.0+10188+4c10031c.x86_64.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update toolbox-0.0.7-1.module+el8.3.0+10188+4c10031c.noarch.rpmLinux
(RHSA-2021:0706) container-tools:2.0 security update udica-0.2.1-2.module+el8.3.0+10188+4c10031c.noarch.rpmLinux
(RHSA-2021:0705)Important: security update buildah-debuginfo-1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update containernetworking-plugins-debuginfo-0.7.4-4.git9ebe139.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update criu-debuginfo-3.12-9.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update fuse-overlayfs-debuginfo-0.3-5.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update podman-debuginfo-1.0.0-8.git921f98f.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update runc-debuginfo-1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update skopeo-debuginfo-0.1.32-6.git1715c90.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
(RHSA-2021:0705)Important: security update slirp4netns-debuginfo-0.1-5.dev.gitc4e1bc5.module+el8.3.0+10171+12421f43.x86_64.rpmLinux
container-tools:rhel8 security, bug fix, and enhancement update (RLSA-2020:3053) toolbox-0.0.7-1.module+el8.5.0+770+e2f49861.noarch.rpmLinux
container-tools:1.0 security update (RLSA-2021:0705) oci-umount-2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f.x86_64.rpmLinux
container-tools:1.0 security update (RLSA-2021:0705) oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f.x86_64.rpmLinux
container-tools:2.0 security update (RLSA-2021:0706) toolbox-0.0.7-1.module+el8.5.0+770+e2f49861.noarch.rpmLinux
Buildah update (ELSA-2021-0705) buildah-1.5-8.gite94b4f9.0.1.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Container-selinux update (ELSA-2021-0705) container-selinux-2.124.0-1.gitf958d0c.module+el8.3.0+9668+293abd4d.noarch.rpmLinux
Containernetworking-plugins update (ELSA-2021-0705) containernetworking-plugins-0.7.4-4.git9ebe139.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Containers-common update (ELSA-2021-0705) containers-common-0.1.32-6.git1715c90.0.1.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Crit update (ELSA-2021-0705) crit-3.12-9.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Criu update (ELSA-2021-0705) criu-3.12-9.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Fuse-overlayfs update (ELSA-2021-0705) fuse-overlayfs-0.3-5.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Oci-systemd-hook update (ELSA-2021-0705) oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Oci-umount update (ELSA-2021-0705) oci-umount-2.3.4-2.git87f9237.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Podman update (ELSA-2021-0705) podman-1.0.0-8.git921f98f.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Podman-docker update (ELSA-2021-0705) podman-docker-1.0.0-8.git921f98f.module+el8.3.0+9668+293abd4d.noarch.rpmLinux
Python3-criu update (ELSA-2021-0705) python3-criu-3.12-9.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Runc update (ELSA-2021-0705) runc-1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Skopeo update (ELSA-2021-0705) skopeo-0.1.32-6.git1715c90.0.1.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Slirp4netns update (ELSA-2021-0705) slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.3.0+9668+293abd4d.x86_64.rpmLinux
Important: container-tools:1.0 security update oci-systemd-hook-0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update oci-umount-2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update fuse-overlayfs-0.3-5.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update runc-1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update skopeo-0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update slirp4netns-0.1-5.dev.gitc4e1bc5.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update buildah-1.5-8.gite94b4f9.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update container-selinux-2.124.0-1.gitf958d0c.module_el8.3.0+2044+12421f43.noarch.rpmLinux
Important: container-tools:1.0 security update containernetworking-plugins-0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update containers-common-0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update podman-1.0.0-8.git921f98f.module_el8.3.0+2044+12421f43.x86_64.rpmLinux
Important: container-tools:1.0 security update podman-docker-1.0.0-8.git921f98f.module_el8.3.0+2044+12421f43.noarch.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234