Podman checkpoint image annotation silently disables all container sandboxing on podman run

#!/usr/bin/env bash
# check_cve_2026_94603.sh
# Verify whether host is vulnerable to CVE-2026-94603
# Podman checkpoint image annotation sandbox bypass
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -uo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
NC='\033[0m'

# Check if podman is installed
if ! command -v podman &>/dev/null; then
    echo -e "${GREEN}PATCHED${NC} — Podman is not installed on this host."
    exit 0
fi

PODMAN_VERSION=$(podman --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "${PODMAN_VERSION:-}" ]]; then
    echo -e "${YELLOW}UNKNOWN${NC} — Could not determine Podman version."
    exit 2
fi

echo "Detected Podman version: $PODMAN_VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$PODMAN_VERSION"

VULNERABLE=false

if [[ "$MAJOR" -lt 4 ]]; then
    # v3.x and below: checkpoint image support not present
    echo -e "${GREEN}PATCHED${NC} — Podman $PODMAN_VERSION predates checkpoint image support in podman run."
    exit 0
elif [[ "$MAJOR" -eq 4 ]]; then
    # v4.x: checkpoint images supported, no backport fix available
    VULNERABLE=true
elif [[ "$MAJOR" -eq 5 ]]; then
    # v5.x branch: vulnerable if < 5.8.8
    if [[ "$MINOR" -lt 8 ]]; then
        VULNERABLE=true
    elif [[ "$MINOR" -eq 8 && "$PATCH" -lt 8 ]]; then
        VULNERABLE=true
    fi
elif [[ "$MAJOR" -eq 6 ]]; then
    # v6.x branch: vulnerable if < 6.1.3
    if [[ "$MINOR" -lt 1 ]]; then
        VULNERABLE=true
    elif [[ "$MINOR" -eq 1 && "$PATCH" -lt 3 ]]; then
        VULNERABLE=true
    fi
else
    # v7.x+: presumably patched
    echo -e "${GREEN}PATCHED${NC} — Podman $PODMAN_VERSION is newer than affected versions."
    exit 0
fi

# Check CRIU availability (exploit requires CRIU for restore)
CRIU_INSTALLED=false
if command -v criu &>/dev/null; then
    CRIU_INSTALLED=true
elif rpm -q criu &>/dev/null 2>&1; then
    CRIU_INSTALLED=true
elif dpkg -l criu 2>/dev/null | grep -q '^ii'; then
    CRIU_INSTALLED=true
fi

if $VULNERABLE; then
    echo -e "${RED}VULNERABLE${NC} — Podman $PODMAN_VERSION is affected by CVE-2026-94603."
    if $CRIU_INSTALLED; then
        echo "  [!] CRIU is installed — checkpoint restore is fully functional. Exploit is viable."
    else
        echo "  [i] CRIU is NOT installed — exploit requires CRIU for checkpoint restore."
        echo "      Risk is reduced but the vulnerable code path exists. Upgrade recommended."
    fi
    echo ""
    if [[ "$MAJOR" -eq 4 ]]; then
        echo "  Fix: No backport available for v4.x. Upgrade to Podman >= 5.8.8 or >= 6.1.3."
    elif [[ "$MAJOR" -eq 5 ]]; then
        echo "  Fix: Upgrade to Podman >= 5.8.8."
    elif [[ "$MAJOR" -eq 6 ]]; then
        echo "  Fix: Upgrade to Podman >= 6.1.3."
    fi
    exit 1
else
    echo -e "${GREEN}PATCHED${NC} — Podman $PODMAN_VERSION is not affected by CVE-2026-94603."
    exit 0
fi