It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
Weakness
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libpod | Libpod_project | * | 0.6.1 (excluding) |
| Red Hat Enterprise Linux 7 Extras | RedHat | podman-0:0.6.1-3.git3e0ff12.el7 | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/104.html
- https://cwe.mitre.org/data/definitions/470.html
- https://cwe.mitre.org/data/definitions/69.html
References
- https://access.redhat.com/errata/RHSA-2018:2037
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
- https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
- https://access.redhat.com/errata/RHSA-2018:2037
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
- https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24