Red Hat Build Of Podman Desktop
Monthly
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman Desktop, Red Hat OpenShift/CRC tooling and related Red Hat products), lets an attacker who can reach the /services/forwarder/expose control endpoint supply an arbitrary socket path that is passed unsanitised to os.Remove, resulting in deletion of arbitrary files on the host. The defect is reachable without credentials (PR:N) but requires adjacent/guest-side network access to the forwarder API (AV:A), which is normally bound to the virtual network rather than exposed as a routed internet service; impact is limited to integrity and availability (no data disclosure). No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); an upstream fix exists in gvisor-tap-vsock PR #718. The vendor score of 9.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) reflects low-complexity, unauthenticated access combined with a scope change and High integrity/availability impact, and the actual risk depends heavily on whether the forwarder control API is reachable by an untrusted guest or adjacent host.
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman Desktop, Red Hat OpenShift/CRC tooling and related Red Hat products), lets an attacker who can reach the /services/forwarder/expose control endpoint supply an arbitrary socket path that is passed unsanitised to os.Remove, resulting in deletion of arbitrary files on the host. The defect is reachable without credentials (PR:N) but requires adjacent/guest-side network access to the forwarder API (AV:A), which is normally bound to the virtual network rather than exposed as a routed internet service; impact is limited to integrity and availability (no data disclosure). No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); an upstream fix exists in gvisor-tap-vsock PR #718. The vendor score of 9.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) reflects low-complexity, unauthenticated access combined with a scope change and High integrity/availability impact, and the actual risk depends heavily on whether the forwarder control API is reachable by an untrusted guest or adjacent host.