Podman gvproxy API Vulnerability in libpod: Potential Exposure of Private Services
Summary
CVE-2021-4024: A flaw was found in podman. Affects libpod across 2 version ranges.
< 3.4.3+ds1-1
< 3450a60d2196cc0bee8a3fc28a7c93a7370d4515
Fixed in 3.4.3+ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that allows users to create and manage containers and pods. It is designed to be a drop-in replacement for Docker, providing a similar command-line interface and functionality without requiring a daemon. The libpod package is a core component of Podman, responsible for managing the lifecycle of containers and pods. This vulnerability affects the podman machine function, which creates and manages a virtual machine for running Podman processes, exposing potential security risks if not properly configured.
Vulnerability Detail
A flaw was found in Podman where the podman machine function spawns a gvproxy process on the host system. The gvproxy API is accessible on port 7777 on all IP addresses of the host. If this port is open on the host's firewall, an attacker can exploit the gvproxy API to forward ports from the host to the virtual machine, potentially exposing private services running within the VM to the network. This vulnerability can also be leveraged to disrupt the host's services by forwarding all ports to the VM, leading to significant security risks.
How To Fix
Minimum fixed version
3.4.3+ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that port 7777 is blocked on the host's firewall to prevent unauthorized access to the gvproxy API. You can use the following command to block the port:
sudo ufw deny 7777
Conclusion
The vulnerability in the Podman gvproxy API poses significant security risks by potentially exposing private services and disrupting host operations. It is crucial to update the libpod package to the fixed version to safeguard against these threats. Additionally, implementing firewall rules can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for libpod →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to access private services running in the Podman virtual machine or disrupt the host's services.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, ensure that port 7777 is blocked on your firewall as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libpod.
