Listen to this Post
How the CVE Works
When `firewalld` reloads (via firewall-cmd --reload, systemctl reload firewalld, or SIGHUP), Docker fails to restore critical `iptables` rules that isolate bridge networks. This allows containers in non-internal networks to communicate unrestricted, bypassing network segmentation. Internal networks (--internal) remain unaffected. Rootless Mode and Docker Desktop are not vulnerable. The flaw persists until Docker is restarted or networks are recreated.
DailyCVE Form
Platform: Docker Engine
Version: < 25.0.13
Vulnerability: Network isolation bypass
Severity: Critical
Date: 2024-02-29
Prediction: Patch expected by 2024-03-15
What Undercode Say
firewall-cmd --reload Triggers the flaw iptables -L -n -v Verify missing DOCKER-ISOLATION rules docker network ls Check bridge networks systemctl restart docker Workaround
How Exploit
1. Attacker gains access to a container.
2. Scans other containers/networks post-`firewalld` reload.
3. Exploits exposed services due to missing isolation.
Protection from this CVE
- Upgrade to Moby 25.0.13+.
- Avoid `firewalld` reloads in production.
- Use `–internal` for sensitive networks.
Impact
- Unauthorized cross-container access.
- Potential lateral movement.
- Breach of network segmentation.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
