Description
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | psgo | podman 4.0, psgo 1.7.2 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2070368Issue Tracking, Third Party Advisory
- https://github.com/containers/podman/issues/10941Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
- https://security.netapp.com/advisory/ntap-20240628-0001/
- https://bugzilla.redhat.com/show_bug.cgi?id=2070368Issue Tracking, Third Party Advisory
- https://github.com/containers/podman/issues/10941Exploit, Issue Tracking, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
- https://security.netapp.com/advisory/ntap-20240628-0001/
Timeline
- Published
- Apr 29, 2022
- Last modified
- Jun 17, 2026
- NVD status
- Modified