GHSA-fx76-2j3w-2mx6: Input Validation
Impact
When running podman quadlet install --replace to replace a Quadlet file, if the original Quadlet is larger than the new Quadlet, the file would not be truncated and content from the original would be preserved. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files (see https://github.com/podman-container-tools/podman/issues/29013). However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.
First introduced in commit 0ea4eaee70b7458bcc99d875529761faf5172651 with podman 5.7.0
Patches a38a9b7d20915c55e6f3c451101ae72d6da33742 (fixed in 6.0.0)
d3adfdeec7d5c9eee5a6978df3bee62a866c958d d4fe9154ec6e32a02d5fcd096c4a27c38f2040f4 (for v5.8 branch, fixed in 5.8.6)
Workarounds Manually copy the quadlet files to the quadlet directory.
Credits
Podman thanks Christopher Lusk <clusk@northecho.dev> (North Echo Security Research) for reporting the security impact of this problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/containers/podman/v5to a version that resolves this vulnerability.Fixed in 5.8.6 - Upgrade
Upgrade
podmanto a version that resolves this vulnerability.Fixed in 6.0.0Patch a38a9b7d20915c55e6f3c451101ae72d6da33742 - Upgrade
Upgrade
podmanto a version that resolves this vulnerability.Fixed in 5.8.6Patch d3adfdeec7d5c9eee5a6978df3bee62a866c958d - Operational
Manually copy the Quadlet files to the Quadlet directory instead of using `podman quadlet install --replace`.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who run "podman quadlet install --replace" are exposed when replacing an existing Quadlet with a smaller file. Exploitation requires local access, low privileges, and user interaction according to the supplied severity vector.
What must happen for the old configuration to remain active?
The replacement Quadlet must be shorter than the original, leaving old trailing content behind. This is particularly significant when the removed content was at the end of the file, such as an AddCapability option or Volume Quadlet mounts.
How can I determine whether a replacement was affected?
Check the resulting installed Quadlet after using "podman quadlet install --replace", especially when the new file was smaller than the old one. Look for trailing options or mounts from the previous version that were intended to be removed.
What is the practical impact if the retained file remains valid?
Security-related options that were meant to be removed can continue to apply, causing unintended behavior. For Volume Quadlets, retained mounts can expose content to containers, which may later be leaked if an updated image is compromised.