CVE-2021-20188
📋 TL;DR
A privilege escalation vulnerability in Podman allows non-root users inside privileged containers to access any file, including root-owned files. This affects users running Podman containers with privileged mode enabled. The vulnerability compromises container isolation but doesn't directly allow container escape.
💻 Affected Systems
- Podman
📦 What is this software?
Podman by Podman Project
⚠️ Risk & Real-World Impact
Worst Case
Malicious user inside privileged container reads/modifies sensitive files, potentially compromising containerized applications and data.
Likely Case
Accidental or malicious file access within container leading to data exposure or corruption.
If Mitigated
Limited impact if containers run with proper user restrictions and without privileged mode.
🎯 Exploit Status
Requires user access inside privileged container. No public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1915734
Restart Required: Yes
Instructions:
1. Update Podman to version 1.7.0 or later using your package manager. 2. Restart any affected containers. 3. Verify version with 'podman --version'.
🔧 Temporary Workarounds
Avoid privileged containers
linuxRun containers without privileged mode unless absolutely necessary.
podman run --security-opt=no-new-privileges image:tag
Use user namespace isolation
linuxEnable user namespace mapping to isolate container users from host.
podman run --userns=keep-id image:tag
🧯 If You Can't Patch
- Avoid using privileged containers entirely
- Implement strict access controls and monitoring for privileged containers
🔍 How to Verify
Check if Vulnerable:
Check Podman version and if containers run with --privileged flag.Check Version:
podman --versionVerify Fix Applied:
Confirm Podman version is 1.7.0+ and test file access within privileged container.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns within containers
- Privileged container creation events
Network Indicators:
- N/A - local container vulnerability
SIEM Query:
source="podman" AND "privileged" AND (event="create" OR event="run")