CVE-2021-4024 Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman

What is CVE-2021-4024?

CVE-2021-4024 is a medium-severity server-side request forgery vulnerability in Fedoraproject Fedora, published on 23 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.

Weakness: CWE-346, CWE-200

Which versions are affected by CVE-2021-4024?

5 open source packages ship an affected version, including github.com/containers/podman/v3, github.com/containers/podman and github.com/containers/podman/v2. It affects 3 products.

Products include Fedoraproject Fedora, Podman Project Podman, Redhat Enterprise Linux.

How do I fix CVE-2021-4024?

Upgrade github.com/containers/podman/v3 to 3.4.3 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-4024 being exploited?

There is no known exploitation of CVE-2021-4024 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-4024, GHSA-3cf2-x423-x582, GO-2022-0281, UBUNTU-CVE-2021-4024.