Listen to this Post
When firewalld is reloaded (e.g., via firewall-cmd --reload), Docker fails to restore critical iptables rules that isolate container networks. This allows remote hosts to bypass intended restrictions if they have a route to the Docker bridge network. Attackers can access published ports originally bound only to loopback addresses. For example, a host on the same network can add a route (ip route add 172.17.0.0/16 via <Docker_host_IP>) to reach exposed container ports. Unpublished ports and `–internal` networks remain protected. Rootless Mode and Docker Desktop are unaffected.
DailyCVE Form
Platform: Docker Engine
Version: <28.3.3
Vulnerability: Firewall bypass
Severity: Critical
Date: 2024-02-26
Prediction: Patch expected by 2024-03-05
What Undercode Say
Check Docker version docker --version Verify firewalld reload impact iptables -L -n | grep DOCKER-ISOLATION Manual rule restoration (workaround) systemctl restart docker
How Exploit
- Attacker on local network routes traffic to Docker subnet.
2. Accesses published ports bound to `127.0.0.1`.
3. Bypasses network isolation rules.
Protection from this CVE
- Upgrade to Moby 28.3.3+.
- Avoid `firewalld –reload` without Docker restart.
- Use Rootless Mode or `–internal` networks.
Impact
- Unauthorized network access to containers.
- Exposure of loopback-bound services.
- Requires local network foothold.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
