-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the podman kube play command, specifically within the playKubePod function, which handles the creation of files from Kubernetes ConfigMaps and Secrets into volumes. The root cause is the use of os.Create to write files to the volume. This function follows symbolic links, which creates a time-of-check-to-time-of-use (TOCTOU) vulnerability. An attacker could exploit this by running a pod that creates a symbolic link inside the volume, pointing to a sensitive file on the host system. When podman kube play is executed again with the same volume, the playKubePod function follows the symlink and overwrites the targeted host file with the contents specified in the ConfigMap or Secret. The provided patch rectifies this by replacing the vulnerable os.Create call with a new, safer function called openPathSafely. This new function uses unix.Openat with the O_NOFOLLOW flag to explicitly prevent following symbolic links, and further contains file operations within the intended directory using securejoin, thus closing the symlink traversal vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containers/podman/v5 | go | <= 5.6.0 | 5.6.1 |
| github.com/containers/podman/v4 | go | <= 4.9.5 |