REDHAT-BUG-2270717
First published: Thu Mar 21 2024(Updated: )
Summary: We received a report of an attack vector on containers which share an IPC namespace (definitely Podman, but likely also applicable to Kubernetes, Docker, and other container runtimes). At least two containers are configured with a shared IPC namespace and a cgroup limiting memory. One of those containers is malicious, and contains a binary which creates a large number of IPC resources in /dev/shm, and continues doing so until it is OOM killed. The malicious container is now dead, its cgroup removed, but the IPC resources it created are not; they are tied to the IPC namespace that will not be removed until all containers using it are stopped, and one non-malicious container is holding the namespace open. The malicious container is restarted (either automatically or by attacker control), repeating the process and increasing the amount of memory consumed. With a container configured to restart always (e.g. `podman run --restart=always`) this results in a memory-based denial of service of the system. Podman Version: Version 5.0.0-dev and before
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Podman | <5.0.0-dev |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2270717?
The severity of REDHAT-BUG-2270717 is significant due to the potential for unauthorized access between containers sharing an IPC namespace.
How do I fix REDHAT-BUG-2270717?
To fix REDHAT-BUG-2270717, avoid configuring containers with a shared IPC namespace.
Which container technologies are affected by REDHAT-BUG-2270717?
REDHAT-BUG-2270717 affects Podman, and potentially Kubernetes and Docker, when containers share an IPC namespace.
What is the attack vector described in REDHAT-BUG-2270717?
The attack vector in REDHAT-BUG-2270717 involves containers that share an IPC namespace, allowing inter-container communication that could lead to exploitation.
Is REDHAT-BUG-2270717 applicable to production environments?
Yes, REDHAT-BUG-2270717 is applicable to production environments utilizing affected container technologies, and precautions should be taken.
- agent/severity
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-3056
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/podman
- canonical/podman