# HCSEC-2021-14 - Nomad Bridge Networking Mode Allows ARP Spoofing From Other Bridged Tasks On Same Node

**URL:** <https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296>\
**Category:** Security\
**Tags:** security-nomad\
**Created:** [May 12, 2021, 10:29pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296 "2021-05-12T22:29:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [May 12, 2021, 10:29pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296/1 "2021-05-12T22:29:28Z")

</div>

**Bulletin ID:** HCSEC-2021-14  
**Affected Products / Versions:** Nomad and Nomad Enterprise up to 1.0.4; fixed in 0.12.12, 1.0.5 and 1.1.0 RC1  
**Publication Date:** May 12, 2021

**Summary**  
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that Nomad’s bridge networking mode allows ARP spoofing from other bridged tasks on the same node. This vulnerability, CVE-2021-32575, affects all Nomad versions up to 1.0.4, and is fixed in the 0.12.12, 1.0.5 and 1.1.0 RC1 releases.

**Background**  
Nomad [task drivers](https://www.nomadproject.io/docs/drivers) implement various levels of resource isolation. For network-level isolation, Nomad provides a bridge [networking mode](https://www.nomadproject.io/docs/job-specification/network#mode) that will place tasks inside the same group inside an isolated network namespace. This network namespace is connected with the host using a virtual network interface through the CNI bridge plugin.

**Details**  
It was discovered that processes launched by the [docker](https://www.nomadproject.io/docs/drivers/docker), [exec](https://www.nomadproject.io/docs/drivers/exec), and [java](https://www.nomadproject.io/docs/drivers/java) task drivers that make use of Nomad’s bridge networking mode can perform ARP spoofing attacks against other tasks on the same node. Specifically, tasks making use of bridge networking are susceptible to other tasks on the same node performing DoS and MITM attacks due to the default enablement of the [`CAP_NET_RAW`](https://linux.die.net/man/7/capabilities) Linux capability by these task drivers.

This affects all known versions of Nomad, but exposure is specific to Nomad clients running docker, exec, or java task drivers on Linux with tasks making use of bridge networking mode. Third-party driver plugins that use the shared library code may be similarly affected.

The fix may be considered breaking for some Nomad environments, as it disables the `CAP_NET_RAW` Linux capability by default for docker, exec, and java task drivers. Previous behavior can be restored for the docker task driver using the [allow\_caps](https://www.nomadproject.io/docs/drivers/docker#allow_caps) plugin configuration option, and a future Nomad release will enable similar configurability for the exec and java task drivers.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 0.12.12, 1.0.5, 1.1.0 RC1, or newer. Please refer to [Upgrading Nomad](https://www.nomadproject.io/docs/upgrade) for general guidance and version-specific upgrade notes.

If unable to upgrade immediately, customers may consider disabling `CAP_NET_RAW` or further restricting the Linux capabilities granted by the Nomad docker task driver via the plugin [allow\_caps](https://www.nomadproject.io/docs/drivers/docker#allow_caps) and job spec [cap\_add](https://www.nomadproject.io/docs/drivers/docker#cap_add) and [cap\_drop](https://www.nomadproject.io/docs/drivers/docker#cap_drop) configuration options.

**Acknowledgement**  
This issue was identified by the HashiCorp product security team.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._