CVE-2021-4024: Infoleak
podman machine spawns the gvproxy process, which is intended to forward ports on the host machine to the VM. The gvproxy API runs on Port 7777, but binds to all IPs on the host potentially making private services on the VM accessible to the public internet.
Other sources
A flaw was found in podman. The podman machine function (used to create and manage Podman virtual machine containing a Podman process) spawns a gvproxy process on the host system. The gvproxy API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the gvproxy API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-4024?
CVE-2021-4024 is a vulnerability found in the podman software that allows unauthorized access to the gvproxy API on port 7777.
What is the severity of CVE-2021-4024?
CVE-2021-4024 has a severity value of 6.5, which is classified as medium.
How does CVE-2021-4024 affect Podman?
CVE-2021-4024 affects Podman versions up to 2:4.2.0-3.el9 and versions up to 3.4.3, allowing unauthorized access to the gvproxy API on port 7777.
How can I fix CVE-2021-4024?
To fix CVE-2021-4024, update your Podman software to version 2:4.2.0-3.el9 or version 3.4.3 or later.
Where can I find more information about CVE-2021-4024?
You can find more information about CVE-2021-4024 at the following references: [CVE.org](https://www.cve.org/CVERecord?id=CVE-2021-4024), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-4024), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2026675), [Red Hat Errata](https://access.redhat.com/errata/RHSA-2022:7954).