Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 829896 (CVE-2021-4024) - <app-containers/podman-3.4.3: insufficient network isolation
Summary: <app-containers/podman-3.4.3: insufficient network isolation
Status: CONFIRMED
Alias: CVE-2021-4024
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [glsa?]
Keywords:
Depends on: 829942
Blocks:
  Show dependency tree
 
Reported: 2021-12-24 05:01 UTC by John Helmert III
Modified: 2021-12-27 04:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-24 05:01:03 UTC 
CVE-2021-4024:

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

Fix in 3.4.3, please stabilize if suitable.
Comment 1 Zac Medico gentoo-dev 2021-12-24 22:28:12 UTC 
Yes, please stabilize app-containers/podman-3.4.4.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-12-24 22:45:12 UTC 
(In reply to Zac Medico from comment #1)
> Yes, please stabilize app-containers/podman-3.4.4.

Thanks Zac! Filed a separate bug as we changed the workflow recently
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-26 02:08:07 UTC 
Please cleanup
Comment 4 Larry the Git Cow gentoo-dev 2021-12-27 03:30:53 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6819900b9fa79993e945717014bcbafb8b0bfd15

commit 6819900b9fa79993e945717014bcbafb8b0bfd15
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2021-12-27 03:30:03 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2021-12-27 03:30:24 +0000

    app-containers/podman: Remove vulnerable version
    
    Closes: https://bugs.gentoo.org/829896
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 app-containers/podman/Manifest            |   1 -
 app-containers/podman/podman-3.4.1.ebuild | 164 ------------------------------
 2 files changed, 165 deletions(-)