medium6.6

CVE-2025-67499

CNA Plugins Portmap nftables backend can intercept non-local traffic

Impact

### Background The CNI `portmap` plugin allows containers to emulate opening a host port, forwarding that traffic to the container. For example, if a host has the IP 198.51.100.42, a container may request that all packets to `198.51.100.42:53` be forwarded to the container's network. ### Vulnerability When the `portmap` plugin is configured with the `nftables` backend, it inadvertently forwards all traffic with the same destination port as the host port, **ignoring the destination IP**. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. In the given example above, traffic destined to port 53 but for a _separate container_ would still be captured and forwarded, even though it was not destined for the host. ### Impact Containers (i.e. kubernetes pods) that request HostPort forwarding can intercept all traffic destined for that port. This requires that the `portmap` plugin be explicitly configured to use the `nftables` backend. (The `iptables` backend is the default.) ### Patches This is fixed as of CNI plugins v1.9.0 ### Workarounds Configure the `portmap` plugin to use the `iptables` backend. It does not have this vulnerability.

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/containernetworking/plugins`	>= 1.6.0, < 1.9.0	1.9.0

Affected products

Vendor	Product	Affected versions
Linuxfoundation	Cni Network Plugins	from 1.6.0 before 1.9.0

Weakness classification

CWE-200

Impact

Affected packages

Affected products

Weakness classification

References