CVE-2021-4024

Name	CVE-2021-4024
Description	A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1000844

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libpod (PTS)	bullseye	3.0.1+dfsg1-3+deb11u5	fixed
	bookworm	4.3.1+ds1-8+deb12u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libpod	source	bullseye	(not affected)
libpod	source	(unstable)	3.4.3+ds1-1			1000844

Notes

[bullseye] - libpod <not-affected> (Vulnerable code introduced later)
https://bugzilla.redhat.com/show_bug.cgi?id=2026675
https://twitter.com/discordianfish/status/1463462371675066371
https://github.com/containers/podman/pull/12283
Introduced by: https://github.com/containers/podman/commit/7ef3981abe2412727840a2886489a08c03a05299 (v3.3.0-rc1)
Fixed by: https://github.com/containers/podman/commit/295d87bb0b028e57dc2739791dee4820fe5fcc48 (main)
Fixed by: https://github.com/containers/podman/commit/57c5e2246efeaf2fef820a482241f1cc43960c7a (v3.4.3)