GHSA-6jhp-7446-hf7f: Docker Engine overlay-network encryption rules are not restored after a firewalld reload
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
After a firewalld reload deletes the encrypted overlay network's iptables rules, remove the encrypted network's last local endpoint and add another, or restart dockerd, to restore the rules.