CVE-2025-8283
published 2025-07-28CVE-2025-8283: A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may…
PriorityP414low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
0.34%
26.1th percentile
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | netavark | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
osv3.7LOW
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Netavark Has Possible DNS Resolve Confusion
ghsa·2025-07-28
CVE-2025-8283 [LOW] CWE-15 Netavark Has Possible DNS Resolve Confusion
Netavark Has Possible DNS Resolve Confusion
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
OSV
Netavark Has Possible DNS Resolve Confusion
osv·2025-07-28
CVE-2025-8283 [LOW] Netavark Has Possible DNS Resolve Confusion
Netavark Has Possible DNS Resolve Confusion
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
OSV
CVE-2025-8283: A vulnerability was found in the netavark package, a network stack for containers used with Podman
osv·2025-07-28·CVSS 3.7
CVE-2025-8283 [LOW] CVE-2025-8283: A vulnerability was found in the netavark package, a network stack for containers used with Podman
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Red Hat
netavark: podman: netavark may resolve hostnames to unexpected hosts
vendor_redhat·2025-07-28·CVSS 3.7
CVE-2025-8283 [LOW] CWE-15 netavark: podman: netavark may resolve hostnames to unexpected hosts
netavark: podman: netavark may resolve hostnames to unexpected hosts
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
A vulnerability was found in the netavark package, a network sta
Debian
CVE-2025-8283: netavark - A vulnerability was found in the netavark package, a network stack for container...
vendor_debian·2025·CVSS 3.7
CVE-2025-8283 [LOW] CVE-2025-8283: netavark - A vulnerability was found in the netavark package, a network stack for container...
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-8283 netavark: podman: netavark may resolve hostnames to unexpected hosts
bugzilla·2025-07-28·CVSS 3.7
CVE-2025-8283 [LOW] CVE-2025-8283 netavark: podman: netavark may resolve hostnames to unexpected hosts
CVE-2025-8283 netavark: podman: netavark may resolve hostnames to unexpected hosts
Netavark was recently changed, when being used with podman, to remove the dns.podman search domain in detriment of using the host's search domain in the container. This leads to a possible DNS resolve confusion in some scenarios where the container created using podman have the same hostname as an external service. This may lead to containers communicating to unexpected servers instead of the desired one.
Discussion:
Upstream commit fixing this issue:
https://github.com/containers/netavark/pull/1256/commits/03f12695a696c7fe407eefebd7d5ad3cf2e934fe
Bugzilla
CVE-2025-21780 kernel: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
bugzilla·2025-02-27·CVSS 7.8
CVE-2025-21780 [HIGH] CVE-2025-21780 kernel: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
CVE-2025-21780 kernel: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
It malicious user provides a small pptable through sysfs and then
a bigger pptable, it may cause buffer overflow attack in function
smu_sys_set_pp_table().
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022607-CVE-2025-21780-8283@gregkh/T
2025-07-28
Published