Listen to this Post
Netavark, a network stack for containers used with Podman, mishandles DNS resolution due to the removal of the `dns.podman` search domain. When a container is created, its hostname is derived from the container name. Previously, Podman’s search domain ensured proper internal resolution. Now, Netavark relies on the host’s resolv.conf, which may include external search domains. If an external domain contains a record matching the container’s hostname, DNS queries may resolve to unintended external servers, leading to potential traffic redirection.
DailyCVE Form
Platform: Netavark
Version: <1.9.0
Vulnerability: DNS Misresolution
Severity: Low
Date: 2025-07-28
Prediction: Patch by 2025-08-15
What Undercode Say
$ podman run --name vulnerable-container $ dig vulnerable-container.external-domain.com $ cat /etc/resolv.conf
How Exploit
- Spoof DNS responses matching container hostnames.
- Redirect internal traffic externally.
Protection from this CVE
- Update Netavark to >=1.9.0 (post-patch).
- Manually enforce `dns.podman` search domain.
Impact
- Unintended DNS resolution.
- Potential traffic interception.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
