Critical Vulnerability in libpod: gvproxy API Exposure on Host System
Summary
DEBIAN-CVE-2021-4024: A flaw was found in podman. Affects libpod versions < 3.4.3+ds1-1. Fixed in 3.4.3+ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libpod is a library used for managing containers and pods in a lightweight manner. It provides functionalities for creating, running, and managing containerized applications. The library is integral to tools like Podman, which allow users to manage containers without requiring a daemon. However, a flaw in the 'podman machine' function has exposed a security risk that could allow unauthorized access to services running within a virtual machine managed by Podman.
Vulnerability Detail
A flaw was found in Podman where the 'podman machine' function spawns a 'gvproxy' process on the host system. This process opens an API on port 7777, accessible from all IP addresses on the host. If the firewall does not block this port, an attacker could exploit the gvproxy API to forward ports from the host to the virtual machine, potentially exposing private services running in the VM to the network. This vulnerability could also be leveraged to disrupt the host's services by redirecting all ports to the VM.
How To Fix
Minimum fixed version
3.4.3+ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpodTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can block access to port 7777 on your firewall to prevent unauthorized access to the gvproxy API. You can do this by executing the following command:
sudo ufw deny 7777
This will help mitigate the risk until the package can be updated.
Conclusion
The vulnerability in libpod related to the gvproxy API poses significant risks by exposing services running in a virtual machine to potential attackers. It is crucial to update the libpod package to the latest version to mitigate these risks. Implementing firewall rules can provide temporary protection while awaiting updates.
See every vulnerability recorded for libpod →
FAQ
The gvproxy process is a component of Podman that facilitates communication between the host and the virtual machine. It allows for port forwarding and API interactions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Leaving port 7777 open can allow attackers to access the gvproxy API, potentially exposing sensitive services running in the virtual machine and disrupting host services.
Yes, you can block access to port 7777 using your firewall as a temporary measure. Use the command 'sudo ufw deny 7777' to restrict access.
If you cannot update the package right away, ensure that port 7777 is blocked on your firewall to minimize exposure until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpod.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
