Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 829896 (CVE-2021-4024)

Summary: <app-containers/podman-3.4.3: insufficient network isolation
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: zmedico
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://bugzilla.redhat.com/show_bug.cgi?id=2026675
Whiteboard: B4 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 829942    
Bug Blocks:    

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-24 05:01:03 UTC 
CVE-2021-4024:

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

Fix in 3.4.3, please stabilize if suitable.
Comment 1 Zac Medico gentoo-dev 2021-12-24 22:28:12 UTC 
Yes, please stabilize app-containers/podman-3.4.4.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-12-24 22:45:12 UTC 
(In reply to Zac Medico from comment #1)
> Yes, please stabilize app-containers/podman-3.4.4.

Thanks Zac! Filed a separate bug as we changed the workflow recently
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-26 02:08:07 UTC 
Please cleanup
Comment 4 Larry the Git Cow gentoo-dev 2021-12-27 03:30:53 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6819900b9fa79993e945717014bcbafb8b0bfd15

commit 6819900b9fa79993e945717014bcbafb8b0bfd15
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2021-12-27 03:30:03 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2021-12-27 03:30:24 +0000

    app-containers/podman: Remove vulnerable version
    
    Closes: https://bugs.gentoo.org/829896
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 app-containers/podman/Manifest            |   1 -
 app-containers/podman/podman-3.4.1.ebuild | 164 ------------------------------
 2 files changed, 165 deletions(-)
Comment 5 Larry the Git Cow gentoo-dev 2024-07-05 07:06:08 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=3671dbb8919b2952a3de8b9a51e7573f2b16d234

commit 3671dbb8919b2952a3de8b9a51e7573f2b16d234
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-07-05 07:05:25 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-07-05 07:06:00 +0000

    [ GLSA 202407-12 ] podman: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/829896
    Bug: https://bugs.gentoo.org/870931
    Bug: https://bugs.gentoo.org/896372
    Bug: https://bugs.gentoo.org/921290
    Bug: https://bugs.gentoo.org/923751
    Bug: https://bugs.gentoo.org/927500
    Bug: https://bugs.gentoo.org/927501
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202407-12.xml | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)