CVE-2025-54388
📋 TL;DR
This vulnerability in Moby/Docker Engine allows containers with ports published only to localhost (127.0.0.1) to become remotely accessible after firewalld service reloads. It affects Docker Engine versions 28.2.0 through 28.3.2 when firewalld is used. The issue occurs because Docker fails to recreate specific iptables rules that block external access after firewalld removes all rules during reload.
💻 Affected Systems
- Docker Engine
- Mirantis Container Runtime
- Moby-based container runtimes
📦 What is this software?
Moby by Mobyproject
⚠️ Risk & Real-World Impact
Worst Case
Containers with sensitive services bound only to localhost become exposed to network-accessible attackers, potentially leading to unauthorized access, data exfiltration, or lateral movement within the network.
Likely Case
Containers with administrative interfaces, monitoring dashboards, or internal APIs become temporarily accessible from the local network after firewalld maintenance or updates, creating a window of exposure.
If Mitigated
If network segmentation is properly implemented and Docker bridge networks are isolated, the exposure is limited to systems that already have routing access to the Docker bridge network.
🎯 Exploit Status
Exploitation requires timing (after firewalld reload) and network access to Docker bridge. No authentication required to access exposed container ports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 28.3.3
Vendor Advisory: https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4
Restart Required: Yes
Instructions:
1. Stop all running containers. 2. Update Docker Engine to version 28.3.3 or later. 3. Restart Docker service. 4. Restart containers.
🔧 Temporary Workarounds
Disable firewalld reload triggers
linuxPrevent firewalld from automatically reloading or schedule reloads during maintenance windows
sudo systemctl mask firewalld
sudo systemctl stop firewalld
Use iptables directly instead of firewalld
linuxConfigure Docker to use iptables directly and disable firewalld integration
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo iptables -F
sudo systemctl restart docker
🧯 If You Can't Patch
- Monitor firewalld reload events and immediately restart Docker service after any reload
- Implement network segmentation to isolate Docker bridge networks from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check Docker version and if firewalld is active: docker version --format '{{.Server.Version}}' && systemctl is-active firewalldCheck Version:
docker version --format '{{.Server.Version}}'Verify Fix Applied:
After patching, test by publishing a port to localhost, reloading firewalld, and verifying the port is not accessible from remote systems📡 Detection & Monitoring
Log Indicators:
- firewalld reload events in system logs
- Docker iptables rule recreation failures
Network Indicators:
- Unexpected network connections to container ports that should be localhost-only
- Port scans detecting exposed container ports
SIEM Query:
source="systemd" "firewalld.*reload" OR source="docker" "iptables.*failed"