Description
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Podman | 1.5.1 | — |
| — | Varlink | 1.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | libpod | 3.0.0+dfsg1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | libpod | No fix yet | — |
| Ubuntu Pro 22.04 LTS | libpod | No fix yet | — |
References
- https://vuldb.com/?id.143949 vdb-entry technical-description
- https://vuldb.com/?ctiid.143949 signature permissions-required
- https://www.exploit-db.com/exploits/47500 exploit
- https://github.com/containers/podman/issues/21628 issue-tracking