A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1650 advisory.

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1650 advisory.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1650 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    * podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0680 advisory.

    The podman tool manages Pods, container images, and containers. It is part of the libpod library, which is     for applications that use container Pods. Container Pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: incorrectly allowed existing files in volumes to be overwritten by a container when it was     created (CVE-2020-1726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185067	Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)	Nessus	Rocky Linux Local Security Checks	high
180939	Oracle Linux 8 : container-tools:ol8 (ELSA-2020-1650)	Nessus	Oracle Linux Local Security Checks	high
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	Nessus	CentOS Local Security Checks	high
143877	SUSE SLES15 Security Update : conmon, fuse-overlayfs, libcontainers-common, podman (SUSE-SU-2020:2731-1)	Nessus	SuSE Local Security Checks	medium
141155	openSUSE Security Update : conmon / fuse-overlayfs / libcontainers-common / etc (openSUSE-2020-1552)	Nessus	SuSE Local Security Checks	medium
141077	openSUSE Security Update : conmon / fuse-overlayfs / libcontainers-common / etc (openSUSE-2020-1559)	Nessus	SuSE Local Security Checks	medium
136053	RHEL 8 : container-tools:rhel8 (RHSA-2020:1650)	Nessus	Red Hat Local Security Checks	high
134390	RHEL 8 : OpenShift Container Platform 4.3.5 podman (RHSA-2020:0680)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-1726

medium

Tenable Plugins

high

high

high

medium

medium

medium

high

medium