Podman: image-supplied checkpoint annotation makes podman run ignore --cap-drop and sandbox flags

Impact

An image that carries the io.podman.annotations.checkpoint.runtime.name annotation is treated by podman run as a checkpoint restore, and the container creation restrictions the operator passed on the command line - including --cap-drop=ALL - are silently dropped. The container's capabilities and sandbox settings then come from state the image author controls, so a tenant or a CI pipeline that only gets to choose an image gets to choose its own privilege level. On a GPU node that habitually runs rootful Podman to reach /dev/nvidia* and the container toolkit, a full capability set is close to host root, and the scope change in the vendor's 10.0 scoring reflects exactly that. Rootless Podman is not affected, because checkpoint and restore are unavailable in that mode.

Who can reach it

Anyone who can get a chosen image run under rootful podman run - a tenant pushing to a registry the node pulls from, or a pipeline that passes an image reference. No credentials on the host are needed beyond that; the flags the operator thought protected them are simply not applied.

What to do

Upgrade Podman to 5.8.8 or 6.1.3 and restart anything long-lived that shells out to it. No node reboot is needed, but running containers created under the flaw keep whatever capabilities they were given, so they must be recreated. Where an upgrade cannot land immediately, running rootless removes the exposure, and pulling only from registries you control narrows it.

References

Related entries

• Rancher: Cluster owners, members and even base users retrieve plaintext credentials via the Kubernetes APICVE-2021-36782 · RancherCritical
• Rancher: Insufficiently protected credentials let project members read passwords and API tokensCVE-2021-36783 · RancherCritical
• Argo CD: Improper access control allows a low-privileged user to escalate to Argo CD adminCVE-2022-24768 · Argo CDCritical
• Rancher: Cleartext credential storage lets managed-cluster users read credentialsCVE-2022-43757 · RancherCritical
• Rancher: Standard users manipulate Kubernetes secrets in the local (management) clusterCVE-2023-22647 · RancherCritical
• Rancher: Update-logic failure misconfigures Rancher's admission webhook, disabling the validation that enforcesCVE-2023-22651 · RancherCritical