CVE-2023-0778 - Vulnerability Details - OpenCVE

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00117.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Podman Project	Podman
Redhat	Enterprise Linux Openshift

Configuration 1 [-]

cpe:2.3:a:podman_project:podman:-:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
container-tools:rhel8-8080020230321153727.0f77c1b7	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:2758	2023-05-16T00:00:00Z
container-tools:4.0-8080020230217080101.8108cfbc	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:2802	2023-05-16T00:00:00Z
Red Hat OpenShift Container Platform 4.13
podman-3:4.4.1-3.rhaos4.13.el8	cpe:/a:redhat:openshift:4.13::el8	RHSA-2023:1325	2023-05-18T00:00:00Z

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2168256
https://github.com/advisories/GHSA-qwqv-rqgf-8qh8
https://nvd.nist.gov/vuln/detail/CVE-2023-0778
https://www.cve.org/CVERecord?id=CVE-2023-0778

History

Mon, 24 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-03-27T00:00:00.000Z

Updated: 2025-02-24T17:25:59.179Z

Reserved: 2023-02-10T00:00:00.000Z

Link: CVE-2023-0778

Vulnrichment

Updated: 2024-08-02T05:24:34.241Z

NVD

Status : Modified

Published: 2023-03-27T21:15:10.240

Modified: 2025-02-24T18:15:16.863

Link: CVE-2023-0778

Redhat

Severity : Moderate

Publid Date: 2023-02-15T15:56:00Z

Links: CVE-2023-0778 - Bugzilla

OpenCVE Enrichment

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:podman_project:podman:-:*:*:*:*:*:*:*", "matchCriteriaId": "92C3D1F8-4CE5-41FE-9D99-F5C5A6ADA0FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system."}], "id": "CVE-2023-0778", "lastModified": "2025-02-24T18:15:16.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-03-27T21:15:10.240", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168256"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168256"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Hongliang Tian (Ant Group), Weijie Liu (Ant Group), XiaoFeng Wang (Indiana University Bloomington), and Zhi Li (Huazhong University of Science and Technology) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2023:2758", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "container-tools:rhel8-8080020230321153727.0f77c1b7", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-05-16T00:00:00Z"}, {"advisory": "RHSA-2023:2802", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "container-tools:4.0-8080020230217080101.8108cfbc", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-05-16T00:00:00Z"}, {"advisory": "RHSA-2023:1325", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "package": "podman-3:4.4.1-3.rhaos4.13.el8", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-05-18T00:00:00Z"}], "bugzilla": {"description": "podman: symlink exchange attack in podman export volume", "id": "2168256", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2168256"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-367", "details": ["A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.", "A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system."], "name": "CVE-2023-0778", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:3.0/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 3.11"}], "public_date": "2023-02-15T15:56:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-0778\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-0778\nhttps://github.com/advisories/GHSA-qwqv-rqgf-8qh8"], "threat_severity": "Moderate"}