Privilege Escalation Vulnerability in Podman (CVE-2021-20188): Inadequate File Permission Checks
Summary
CVE-2021-20188: A flaw was found in podman before 1.7.0. Affects libpod across 2 version ranges.
< 2.0.2+dfsg1-3
< b7ce1157b00af09f4a09e39b377aa3abff46ee05
Fixed in 2.0.2+dfsg1-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that allows users to create, manage, and run containers without requiring a daemon. It is designed to be a drop-in replacement for Docker, providing a similar command-line interface and functionality. Podman supports rootless containers, enabling users to run containers without root privileges, which enhances security. However, prior to version 1.7.0, Podman had a significant vulnerability related to file permissions for non-root users running in privileged containers, which could lead to unauthorized access to sensitive files within the container.
Vulnerability Detail
A flaw was found in Podman before version 1.7.0 where file permissions for non-root users in privileged containers were not properly enforced. This vulnerability allows a low-privileged user inside the container to access any file, including those owned by the root user. Although it does not permit direct escape from the container, the nature of privileged containers means that many security features are disabled, posing a risk to data confidentiality, integrity, and system availability. The CVSS score for this vulnerability is 7.0, indicating a high level of severity.
How To Fix
Minimum fixed version
2.0.2+dfsg1-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid running containers in privileged mode or restrict the use of non-root users within privileged containers until the upgrade can be performed.
Conclusion
CVE-2021-20188 represents a significant security vulnerability in Podman that affects file permissions for non-root users in privileged containers. Upgrading to the latest version is essential to mitigate the risks associated with this flaw. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities and ensure they are protected.
See every vulnerability recorded for libpod →
FAQ
CVE-2021-20188 is a vulnerability in Podman that allows non-root users in privileged containers to access files owned by the root user due to inadequate file permission checks.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
The vulnerability can lead to unauthorized access to sensitive files within the container, potentially compromising data confidentiality and integrity, as well as affecting system availability.
Yes, you can mitigate the risk by avoiding the use of privileged containers or limiting non-root user access within those containers until an upgrade is possible.
The CVSS score for CVE-2021-20188 is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libpod.
