Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 19/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The default seccomp profile used by Podman, as shipped in containers-common, has a flaw that lets a local user who already has low-privilege access to the system get past its rules blocking AF_VSOCK and NETLINK_AUDIT sockets. By setting upper bits in the socket arguments, which the kernel truncates to 32 bits, an attacker can bypass those deny rules and gain limited confidentiality and integrity impact.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. No advisory context yet
- Reach10/20Shipped in major Linux distributions
- Severity4.4/10CVSS 4.4
- No patch5/5No patch listed yet
What would change the score
- Would score about 74 if added to CISA KEV
- Would score about 69 if CISA's SSVC rates exploitation active
- Would score about 41 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- containers-common
Version range not reported
- container-tools:rhel8/containers-common
Version range not reported
- containers-common
Version range not reported
- containers-common
Version range not reported
- podman
Version range not reported
- skopeo
Version range not reported
- containers-common
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
Show all 10 packagesShow fewer packages
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
Evidence 5
- Report
- Repository
- Repository
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.