REDHAT-BUG-2508234: Medium severity Podman Podman vulnerability

This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-20013 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket.

A flaw was found in Podman 5.8.x. The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the replacement Quadlet file is shorter than the original, trailing bytes from the old file — including security-sensitive directives such as Volume= host-access mounts — survive in the installed unit file. The command returns success with no warning.

After a systemd daemon-reload or reboot, these stale directives reactivate host access the administrator explicitly revoked. A subsequent mutable-tag container image pull by an adversarial image can then exploit the retained host-access mounts to read secrets, modify files, or disrupt host services.

The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, OCREATE|OWRONLY without OTRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflinklinux.go (lines 12-19, non-truncating io.Copy fallback).

Upstream fix: Podman 6.0/main branch introduced an atomic temp-file-plus-rename replacement pattern via PRs #28335 (merged 2026-06-05) and #28860 (merged 2026-06-25). The maintained 5.8 branch remains unpatched.

Mitigation: Administrators using 'podman quadlet install --replace' should manually verify the installed unit file contents after each replacement operation, and avoid using --replace with shorter replacement files until a fix is available. Alternatively, manually remove the destination file before running 'podman quadlet install' (without --replace).