Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

Summary

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

Affected versions

• gvisor-tap-vsock

  From 0.4.0 · fixed in 0.9.0

• rh-podman-desktop

  Version range not reported

• rhcertification/redhat-certification-system-ai-10

  Version range not reported

• rhem/flightctl-imagebuilder-worker-rhel10

  Version range not reported

• gvisor-tap-vsock

  Version range not reported

• podman

  Version range not reported

• rhel10/bootc-image-builder

  Version range not reported

• rhel10-eus/rhel-10.0-bootc

  Version range not reported

• rhel10-eus/rhel-10.2-bootc

  Version range not reported

• rhel10/rhel-bootc

  Version range not reported

• ubi10/podman

  Version range not reported

• container-tools:rhel8/podman

  Version range not reported

• gvisor-tap-vsock

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• openshift4/microshift-bootc-rhel10

  Version range not reported

• podman

  Version range not reported

• devspaces/udi-base-rhel10

  Version range not reported

• rhoso-operators/prometheus-podman-exporter-rhel9

  Version range not reported

References 4