Bug 2026675 (CVE-2021-4024) - CVE-2021-4024 podman: podman machine spawns gvproxy with port bound to all IPs
Summary: CVE-2021-4024 podman: podman machine spawns gvproxy with port bound to all IPs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-4024
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2026676 2029450 2029451 2029452
Blocks: 2026677 2026929
TreeView+ depends on / blocked
 
Reported: 2021-11-25 13:35 UTC by Pedro Sampaio
Modified: 2024-12-04 21:22 UTC (History)
22 users (show)

Fixed In Version: podman 3.4.3
Clone Of:
Environment:
Last Closed: 2022-12-06 00:33:58 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:10810 0 None None None 2024-12-04 21:22:04 UTC
Red Hat Product Errata RHSA-2022:7954 0 None None None 2022-11-15 09:47:54 UTC
Red Hat Product Errata RHSA-2024:10289 0 None None None 2024-11-26 06:43:28 UTC

Description Pedro Sampaio 2021-11-25 13:35:46 UTC 
`podman` machine spawns the `gvproxy` process, which is intended to forward ports on the host machine to the VM. The `gvproxy` API runs on Port 7777, but binds to all IPs on the host potentially making private services on the VM accessible to the public internet.
Comment 1 Pedro Sampaio 2021-11-25 13:36:13 UTC 
Created podman tracking bugs for this issue:

Affects: fedora-all [bug 2026676]
Comment 2 Przemyslaw Roguski 2021-11-26 13:33:50 UTC 
Issue also mentioned in the Internet.
References:
https://twitter.com/discordianfish/status/1463462371675066371
Comment 4 Przemyslaw Roguski 2021-11-29 15:42:30 UTC 
This vulnerability is impacting Podman version >=3.3.0 and >=3.4.0 
The port forwarding and gvproxy support was introduced by this PR:
https://github.com/containers/podman/commit/7ef3981abe2412727840a2886489a08c03a05299


Fix is already merged in the main Podman branch:
https://github.com/containers/podman/pull/12283
But new version is not released yet.
Comment 5 Tom Sweeney 2021-11-30 23:00:30 UTC 
@mheon Looks like another candidate for Podman v3.4.3
Comment 8 Przemyslaw Roguski 2021-12-09 11:33:16 UTC 
Podman v3.4.3 contains the fix for this CVE:
https://github.com/containers/podman/releases/tag/v3.4.3
Comment 9 Fedora Update System 2021-12-17 01:10:46 UTC 
FEDORA-2021-6bc3fe7129 has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 11 Fedora Update System 2022-02-08 01:07:48 UTC 
FEDORA-2021-6bd024d2a7 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2022-11-15 09:47:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7954 https://access.redhat.com/errata/RHSA-2022:7954
Comment 14 Product Security DevOps Team 2022-12-06 00:33:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-4024
Comment 15 Red Hat Bugzilla 2023-09-18 04:28:32 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
Comment 16 errata-xmlrpc 2024-11-26 06:43:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:10289 https://access.redhat.com/errata/RHSA-2024:10289
Note You need to log in before you can comment on or make changes to this bug.