A security vulnerability in Podman's rootless containers allows attackers to escape isolation through a copy operation exploit. The flaw affects how Podman handles file operations in unprivileged container environments.
The Copy Fail exploit targets Podman rootless containers, which run without root privileges on the host system. Researchers discovered that the vulnerability enables attackers to break out of container isolation by manipulating copy operations between the container and host filesystem.
Rootless containers are increasingly popular for their security benefits, allowing users to run containerized applications without granting root access. However, this vulnerability demonstrates a gap in Podman's implementation of file operation security.
The exploit works by leveraging how Podman manages file permissions and ownership during copy operations. An attacker with access to a rootless container can execute commands that expose or modify files outside the container's intended boundaries.
Podman maintainers have been notified of the issue. Users running rootless containers should monitor for security updates and consider temporary mitigations until patches are available. The vulnerability highlights the ongoing challenge of securing containerization features that operate at lower privilege levels.
Caller ID service Truecaller is pushing back against India's telecom regulator over new anti-spam regulations, claiming users are increasingly blocking calls from the country's dedicated business number series.
Telstra customers faced a second day of disruptions Thursday as a secondary outage prevented some from reaching triple-zero emergency services. Regional train services remained affected following Wednesday's initial mobile network failure.
Australia's government has instructed volunteers to discard thousands of functional test routers despite the devices being capable of being reflashed for continued use.
A lawsuit alleges a man used X's Grok AI to create approximately 7,000 sexually explicit images of his stepdaughter before taking his own life. Multiple young girls are now suing X, claiming the platform failed to prevent the abuse.