Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 829896 (CVE-2021-4024)

Summary: <app-containers/podman-3.4.3: insufficient network isolation
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: minor CC: zmedico
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://bugzilla.redhat.com/show_bug.cgi?id=2026675
Whiteboard: B4 [glsa?]
Package list:
Runtime testing required: ---
Bug Depends on: 829942    
Bug Blocks:    

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-24 05:01:03 UTC 
CVE-2021-4024:

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

Fix in 3.4.3, please stabilize if suitable.
Comment 1 Zac Medico gentoo-dev 2021-12-24 22:28:12 UTC 
Yes, please stabilize app-containers/podman-3.4.4.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-12-24 22:45:12 UTC 
(In reply to Zac Medico from comment #1)
> Yes, please stabilize app-containers/podman-3.4.4.

Thanks Zac! Filed a separate bug as we changed the workflow recently
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-26 02:08:07 UTC 
Please cleanup
Comment 4 Larry the Git Cow gentoo-dev 2021-12-27 03:30:53 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6819900b9fa79993e945717014bcbafb8b0bfd15

commit 6819900b9fa79993e945717014bcbafb8b0bfd15
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2021-12-27 03:30:03 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2021-12-27 03:30:24 +0000

    app-containers/podman: Remove vulnerable version
    
    Closes: https://bugs.gentoo.org/829896
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 app-containers/podman/Manifest            |   1 -
 app-containers/podman/podman-3.4.1.ebuild | 164 ------------------------------
 2 files changed, 165 deletions(-)