Permissions, Privileges, and Access Controls in Podman - CVE-2022-27649

Vulnerability identifier: #VU61829

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27649

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to excess inheritable capabilities set, which leads to security restrictions bypass and privilege escalation.

Podman
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Containers
openSUSE Leap
openEuler
Fedora
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox
toolbox-tests
containers-common
skopeo
skopeo-tests
udica
slirp4netns
fuse-overlayfs
containernetworking-plugins
crun
runc
aardvark-dns
netavark
python-podman-api
oci-seccomp-bpf-hook
podman
podman-tests
podman-docker
podman-remote
buildah
buildah-tests
conmon
container-selinux
podman-plugins
podman-catatonit
podman-debuginfo
podman-debugsource
podman-gvproxy
podman-help
python3-criu
criu
crit
criu-devel
criu-libs
python3-podman
libslirp-devel
libslirp
podman-cni-config
podman-remote-debuginfo
cockpit-podman

Install updates from vendor's website.

Podman - addressed in versions 3.4.5, 4.0.3
toolbox - addressed in versions 0.0.7-1, 0.0.99.3-0.4, 0.0.99.3-1
toolbox-tests - addressed in versions 0.0.99.3-0.4, 0.0.99.3-1
containers-common - addressed in versions 0.1.41-4, 1.2.4-1, 1-27
skopeo - addressed in versions 0.1.41-4, 1.2.4-1, 1.6.1-2
skopeo-tests - addressed in versions 0.1.41-4, 1.2.4-1, 1.6.1-2
udica - addressed in versions 0.2.1-2, 0.2.4-1, 0.2.6-2
slirp4netns - addressed in versions 0.4.2-3.git21fdece, 1.1.8-1, 1.1.8-2
fuse-overlayfs - addressed in versions 0.7.8-1, 1.4.0-2, 1.8.2-1
containernetworking-plugins - addressed in versions 0.8.3-4, 0.9.1-1, 1.0.1-2
crun - addressed in versions 0.18-2, 1.4.4-1
runc - addressed in versions 1.0.0-66.rc10, 1.0.0-73.rc95, 1.0.3-2
aardvark-dns - update to 1.0.1-27
netavark - update to 1.0.1-27
python-podman-api - update to 1.2.0-0.2.gitd0a45fe
oci-seccomp-bpf-hook - addressed in versions 1.2.0-3, 1.2.3-3
podman - addressed in versions 1.6.4-28, 3.0.1-8, 4.0.2-6
podman-tests - addressed in versions 1.6.4-28, 3.0.1-8, 4.0.2-6
podman-docker - addressed in versions 1.6.4-28, 3.0.1-8, 4.0.2-6
podman-remote - addressed in versions 1.6.4-28, 3.0.1-8, 4.0.2-6
buildah - addressed in versions 1.11.6-10, 1.19.9-2, 1.24.2-4
buildah-tests - addressed in versions 1.11.6-10, 1.19.9-2, 1.24.2-4
conmon - addressed in versions 2.0.15-1, 2.0.26-1, 2.1.0-1
container-selinux - addressed in versions 2.130.0-1, 2.167.0-1, 2.179.1-1
podman-plugins - addressed in versions 3.0.1-8, 4.0.2-6
podman-catatonit - addressed in versions 3.0.1-8, 4.0.2-6
podman - update to 3.4.4-8
podman-debuginfo - update to 3.4.4-8
podman-debugsource - update to 3.4.4-8
podman-plugins - update to 3.4.4-8
podman-remote - update to 3.4.4-8
podman-gvproxy - update to 3.4.4-8
podman-docker - update to 3.4.4-8
podman-help - update to 3.4.4-8
podman - addressed in versions 3.4.7-1.fc34, 3.4.7-1.fc35, 4.0.3-1.fc36
python3-criu - addressed in versions 3.12-9, 3.15-1, 3.15-3
criu - addressed in versions 3.12-9, 3.15-1, 3.15-3
crit - addressed in versions 3.12-9, 3.15-1, 3.15-3
criu-devel - update to 3.15-3
criu-libs - update to 3.15-3
python3-podman - update to 4.0.0-1
podman-gvproxy - update to 4.0.2-6
libslirp-devel - addressed in versions 4.3.1-1, 4.4.0-1
libslirp - addressed in versions 4.3.1-1, 4.4.0-1
podman-debuginfo - addressed in versions 4.3.1-150300.9.15.1, 4.3.1-150400.4.11.1
podman-cni-config - addressed in versions 4.3.1-150300.9.15.1, 4.3.1-150400.4.11.1
podman - addressed in versions 4.3.1-150300.9.15.1, 4.3.1-150400.4.11.1
podman-remote - update to 4.3.1-150400.4.11.1
podman-remote-debuginfo - update to 4.3.1-150400.4.11.1
podman-docker - update to 4.3.1-150400.4.11.1
cockpit-podman - addressed in versions 11-1, 29-2, 43-1

• https://github.com/containers/libpod/releases/tag/v4.0.3
• https://github.com/containers/libpod/releases/tag/v3.4.5
• https://github.com/podman-container-tools/podman/security/advisories/GHSA-qvf8-p83w-v58j

• Privilege escalation in Podman
• Red Hat Enterprise Linux 8.4 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:3.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 8.2 update for the container-tools:2.0 module
• Red Hat Enterprise Linux 8.4 Extended Update Support update for the container-tools:3.0 module
• SUSE update for podman
• SUSE update for podman
• Fedora 36 update for podman
• Fedora 35 update for podman
• Fedora 34 update for podman
• openEuler 22.03 LTS SP3 update for podman
• openEuler 22.03 LTS SP4 update for podman
• Anolis OS update for container-tools:3.0 module
• Anolis OS update for container-tools:2.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Anolis OS update for container-tools:an8 module