CVE-2023-0778: Medium severity Podman Project Podman vulnerability
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
Other sources
An attacker who has control on a container using a Volume can traverse arbitrary files on the host filesystem (which essentially is an escape) when an administrator tries to export this Volume, by exploiting a TOCTTOU vulnerability to replace a normal file in the Volume as a symlink.
The container-based platform can use Podman as the container engine and provide interfaces that encapsulate common commands (e.g., run, cp, volume create, etc.) for its users to manage the container. We assume that the adversary in the container-based platform can control multiple containers and attempt to escape from the containers, and can also request the platforms via legitimate interfaces to create volumes, start-up containers connected to the volume, migrate (or extract) the volume (by the 'volume export' and 'volume import'), and so on. When the platform performs 'volume export', the adversary can exploit this vulnerability to steal the sensitive file on the host and get it from the exported tarball or the migrated volume.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-0778?
CVE-2023-0778 is a Time-of-check Time-of-use (TOCTOU) flaw found in podman, which may allow a malicious user to access arbitrary files on the host file system.
How does CVE-2023-0778 affect podman?
CVE-2023-0778 affects podman by allowing a malicious user to replace a normal file in a volume with a symlink while exporting the volume.
What is the severity of CVE-2023-0778?
The severity of CVE-2023-0778 is medium, with a severity value of 6.8.
Which software is affected by CVE-2023-0778?
Podman versions up to 3:4.4.1-3.rhaos4.13.el9, Red Hat Enterprise Linux 8.0, and Red Hat Enterprise Linux 9.0 are affected by CVE-2023-0778.
How can I fix CVE-2023-0778?
To fix CVE-2023-0778, update podman to version 3:4.4.1-3.rhaos4.13.el9 or apply the relevant security patch provided by Red Hat for Red Hat Enterprise Linux.