Skip to content
Fencer Vulns
medium 6.8

CVE-2023-0778 json

Podman Time-of-check Time-of-use (TOCTOU) Race Condition

published 2023-03-27 3 y ago modified 2026-06-17 4 mo ago also GHSA-qwqv-rqgf-8qh8 , GO-2023-1681 , EUVD-2023-1087

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Patch / fix

  • go github.com/containers/podman/v4 4.4.2
  • libpod Debian 12 4.3.1+ds1-7

debian advisories DEBIAN-CVE-2023-0778

  • crit RHEL 8 3.15-3.module+el8.8.0+17821+de1b53f1
  • criu RHEL 8 3.15-3.module+el8.8.0+17821+de1b53f1
  • crun RHEL 8 1.6-1.module+el8.8.0+17821+de1b53f1
  • runc RHEL 8 1:1.1.4-1.module+el8.8.0+17821+de1b53f1
  • udica RHEL 8 0.2.6-3.module+el8.8.0+17821+de1b53f1
  • conmon RHEL 8 2:2.1.4-1.module+el8.8.0+17821+de1b53f1
  • podman RHEL 8 2:4.0.2-20.module+el8.8.0+18201+6ad7332c
  • skopeo RHEL 8 2:1.6.2-6.module+el8.8.0+17821+de1b53f1

red hat advisories RHSA-2023:2802RHSA-2023:2758RHSA-2023:1325

  • podman SLE Module for Containers 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +2 more 4.4.4-150400.4.16.1
  • podman SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +4 more 4.4.4-150300.9.20.1

suse advisories SUSE-SU-2023:1814-1SUSE-SU-2023:1812-1

  • podman openSUSE Tumbleweed 4.4.2-1.1

opensuse advisories openSUSE-SU-2024:12771-1

  • crit AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • criu AlmaLinux 8 3.15-3.module_el8.7.0+3407+95aa0ca9
  • crun AlmaLinux 8 1.8.1-2.module_el8.8.0+3568+e8578284
  • runc AlmaLinux 8 1:1.1.4-1.module_el8.7.0+3407+95aa0ca9
  • udica AlmaLinux 8 0.2.6-20.module_el8.8.0+3470+252b1910
  • conmon AlmaLinux 8 3:2.1.6-1.module_el8.8.0+3470+252b1910
  • podman AlmaLinux 8 3:4.4.1-8.module_el8.8.0+3568+e8578284
  • skopeo AlmaLinux 8 2:1.11.2-0.2.module_el8.8.0+3470+252b1910

almalinux advisories ALSA-2023:2758ALSA-2023:2802

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297
  • cockpit-podman Rocky Linux 8 46-1.module+el8.9.0+1445+07728297
  • oci-seccomp-bpf-hook Rocky Linux 8 1.2.5-2.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:2758RLSA-2023:2802

  • podman Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 4.4.2-r0

alpine advisories ALPINE-CVE-2023-0778

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o CBL-Mariner 2.0 1.22.3-10
  • podman Azure Linux 3.0 5.6.1-2

azure linux advisories AZL-39612AZL-45381

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0778 updated cvss 6.8

podman: symlink exchange attack in podman export volume

  • Red Hat Enterprise Linux 7 podman
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +1 more
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 podman
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) crun 1.6-1.module+el8.8.0+17821+de1b53f1, crit 3.15-3.module+el8.8.0+17821+de1b53f1, crit 3.15-3.module+el8.8.0+18060+3f21f2cc, criu 3.15-3.module+el8.8.0+17821+de1b53f1, criu 3.15-3.module+el8.8.0+18060+3f21f2cc, crun 1.8.1-2.module+el8.8.0+18418+f0e540fe, +60 more
    fixed: vendor fix RHSA-2023:2802
  • Red Hat OpenShift Container Platform 4.13 podman 4.4.1-3.rhaos4.13.el8, podman 4.4.1-3.rhaos4.13.el9, podman-tests 4.4.1-3.rhaos4.13.el8, podman-tests 4.4.1-3.rhaos4.13.el9, podman-docker 4.4.1-3.rhaos4.13.el8, podman-docker 4.4.1-3.rhaos4.13.el9, +7 more
    fixed: vendor fix RHSA-2023:1325
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 tox 3.23.0-2.el9.1, crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, future 0.18.2-9.el9.1, subunit 1.4.0-6.el9.1, pyflakes 2.2.0-3.el9.1, +465 more Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat OpenShift Container Platform 4.13 tini 0.16.1-1.el8ar, grpc 1.18.0-4.el8ost, python-rsa 4.7-1.el8, python3-rsa 4.7-1.el8, cri-tools 1.26.0-1.el9, grpc-cli 1.18.0-4.el8ost, +252 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containers/podman/v4
<4.4.2
4.4.2

Affected products

  • n/a podman

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.