CVE-2021-20188 Improper Authorization in github.com/containers/libpod
Low-privileged users in privileged Podman containers can bypass file permission checks to access or modify root-owned files, compromising data confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20188?
CVE-2021-20188 is a high-severity missing authorization vulnerability in Redhat Enterprise Linux, published on 11 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Weakness: CWE-863
Which versions are affected by CVE-2021-20188?
3 open source packages ship an affected version, including github.com/containers/libpod. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/libpod Go | All versions | 1.7.0 |
github.com/containers/libpod Go | All versions | 1.7.0 |
github.com/containers/libpod Go | All versions | 1.7.0 |
Linux distribution packages (37)
buildah AlmaLinux:8 | All versions | 1.5-8.gite94b4f9.module_el8.3.0+2044+12421f43 |
buildah AlmaLinux:8 | All versions | 1.5-8.gite94b4f9.module_el8.4.0+2496+12421f43 |
buildah AlmaLinux:8 | All versions | 1.5-8.gite94b4f9.module_el8.5.0+119+9a9ec082 |
container-selinux AlmaLinux:8 | All versions | 2:2.124.0-1.gitf958d0c.module_el8.3.0+2044+12421f43 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43 |
containernetworking-plugins AlmaLinux:8 | All versions | 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082 |
containers-common AlmaLinux:8 | All versions | 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43 |
containers-common AlmaLinux:8 | All versions | 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43 |
containers-common AlmaLinux:8 | All versions | 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
crit AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
criu AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
fuse-overlayfs AlmaLinux:8 | All versions | 0.3-5.module_el8.3.0+2044+12421f43 |
fuse-overlayfs AlmaLinux:8 | All versions | 0.3-5.module_el8.4.0+2496+12421f43 |
fuse-overlayfs AlmaLinux:8 | All versions | 0.3-5.module_el8.5.0+119+9a9ec082 |
oci-systemd-hook AlmaLinux:8 | All versions | 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43 |
oci-systemd-hook AlmaLinux:8 | All versions | 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43 |
oci-systemd-hook AlmaLinux:8 | All versions | 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082 |
oci-umount AlmaLinux:8 | All versions | 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43 |
oci-umount AlmaLinux:8 | All versions | 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43 |
oci-umount AlmaLinux:8 | All versions | 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082 |
podman AlmaLinux:8 | All versions | 1.0.0-8.git921f98f.module_el8.3.0+2044+12421f43 |
podman AlmaLinux:8 | All versions | 1.0.0-8.git921f98f.module_el8.4.0+2496+12421f43 |
podman AlmaLinux:8 | All versions | 1.0.0-8.git921f98f.module_el8.5.0+119+9a9ec082 |
podman-docker AlmaLinux:8 | All versions | 1.0.0-8.git921f98f.module_el8.3.0+2044+12421f43 |
python3-criu AlmaLinux:8 | All versions | 3.12-9.module_el8.3.0+2044+12421f43 |
python3-criu AlmaLinux:8 | All versions | 3.12-9.module_el8.4.0+2496+12421f43 |
python3-criu AlmaLinux:8 | All versions | 3.12-9.module_el8.5.0+119+9a9ec082 |
runc AlmaLinux:8 | All versions | 1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43 |
runc AlmaLinux:8 | All versions | 1.0.0-56.rc5.dev.git2abd837.module_el8.4.0+2496+12421f43 |
runc AlmaLinux:8 | All versions | 1.0.0-56.rc5.dev.git2abd837.module_el8.5.0+119+9a9ec082 |
skopeo AlmaLinux:8 | All versions | 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43 |
skopeo AlmaLinux:8 | All versions | 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43 |
Products include Podman Project Podman, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2021-20188?
Upgrade github.com/containers/libpod to 1.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-20188 being exploited?
There is no known exploitation of CVE-2021-20188 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-57231 Podman: Malformed Image can trick podman run into leaking host environment variables into the container
- CVE-2022-2738 Use after free in podman
- CVE-2022-2989 Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
- CVE-2023-0778 Podman Time-of-check Time-of-use (TOCTOU) Race Condition
- CVE-2019-25067 Podman/Varlink API Privilege Escalation
Sources
Also known as ALSA-2021:0705, DEBIAN-CVE-2021-20188, GHSA-9h63-7qf6-mv6r, GO-2022-0641, OESA-2021-1123, RHSA-2021:0681 and 5 more.