CVE-2024-3056: 
Podman vulnerability analysis and mitigation

CVE-2024-3056 is a vulnerability discovered in Podman that affects versions through 5.2.0. The vulnerability was disclosed in August 2024 and affects Podman's container management functionality, particularly when containers share IPC namespaces (NVD).

The vulnerability occurs when containers are configured to share the same IPC namespace. An attacker can create a specially crafted container that can create a large number of IPC resources in /dev/shm. When the malicious container reaches its memory limit, it gets OOM (Out-Of-Memory) killed. While the container's cgroup is removed upon termination, the IPC resources it created persist as they are tied to the IPC namespace, which remains active due to other containers using it. The CVSS v3.1 base score is 4.8 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H (NVD).

The primary impact is a potential memory-based denial of service (DoS) of the system. When the malicious container is restarted (either automatically or by attacker control), it can repeat the process, continuously increasing the amount of memory consumed. This is particularly effective when using container configurations like podman run --restart=always, as it allows for persistent resource exhaustion (Red Hat Bugzilla).

The vulnerability requires an attacker to have the ability to create and run containers with shared IPC namespace configurations. The attack can be executed through network namespace sharing (with 'net_admin' privilege) and PID namespace sharing as additional attack vectors. In the PID namespace scenario, attackers can bypass cgroup limits on process numbers by generating zombie processes that accumulate within the shared namespace (Red Hat Bugzilla).

Currently, there is no direct mitigation available as the issue stems from how the Linux kernel handles shared memory in cgroups. When the owning cgroup has exited all its processes and is to be destroyed, it remains in a zombie state due to additional references to the shared memory. The issue is under discussion in the upstream community, but there is no consensus on the best way forward (Red Hat Bugzilla).