Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode.
This issue is fixed in versions 5.8.8 and 6.1.3.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 9
https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca2…
security-advisories@github.com
https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5…
security-advisories@github.com
https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c79…
security-advisories@github.com
https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e…
security-advisories@github.com
https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e1…
security-advisories@github.com
https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51…
security-advisories@github.com
https://github.com/podman-container-tools/podman/releases/tag/v5.8.8
security-advisories@github.com
https://github.com/podman-container-tools/podman/releases/tag/v6.1.3
security-advisories@github.com
https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-…
security-advisories@github.com