CVE-2021-4024Sensitive Information Exposure in Containers Podman V3

Severity
6.5MEDIUMNVD
EPSS
0.1%
top 73.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 23
Latest updateAug 21

Description

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LExploitability: 3.9 | Impact: 2.5

Affected Packages4 packages

NVDpodman_project/podman3.3.03.4.3
CVEListV5podman_project/podmanpodman 3.4.3
Debianlibpod_project/libpod< 3.4.3+ds1-1

Also affects: Fedora 34, 35, Enterprise Linux 8.0

🔴Vulnerability Details

5
OSV
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman in github.com/containers/podman2024-08-21
GHSA
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman2022-01-06
OSV
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman2022-01-06
CVEList
CVE-2021-4024: A flaw was found in podman2021-12-23
OSV
CVE-2021-4024: A flaw was found in podman2021-12-23

📋Vendor Advisories

2
Red Hat
podman: podman machine spawns gvproxy with port bound to all IPs2021-11-24
Debian
CVE-2021-4024: libpod - A flaw was found in podman. The `podman machine` function (used to create and ma...2021