A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade slirp4netnsUpgrade critUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade udicaUpgrade python-podman-apiUpgrade buildahUpgrade criuUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade runcUpgrade buildah-testsUpgrade podman-testsUpgrade toolbox-testsUpgrade conmonUpgrade netavarkUpgrade podman-dockerUpgrade aardvark-dnsUpgrade python3-criuUpgrade libslirpUpgrade libslirp-develUpgrade podmanUpgrade container-selinuxUpgrade podman-pluginsUpgrade python3-podmanUpgrade criu-develUpgrade skopeoUpgrade toolboxUpgrade crunUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade containers-commonUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade podman-remote | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade libslirp-develUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remoteUpgrade python3-criuUpgrade toolbox-debugsourceUpgrade skopeo-testsUpgrade udicaUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade slirp4netns-debuginfoUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade cockpit-podmanUpgrade slirp4netns-debugsourceUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade critUpgrade criu-develUpgrade podman-debuginfoUpgrade python-podman-apiUpgrade podman-dockerUpgrade podman-gvproxy-debuginfoUpgrade runc-debuginfoUpgrade crunUpgrade crun-debuginfoUpgrade container-selinuxUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade runcUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debuginfoUpgrade toolbox-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade podman-catatonit-debuginfoUpgrade skopeo-debugsourceUpgrade podman-pluginsUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade libslirpUpgrade podman-catatonitUpgrade buildah-debuginfoUpgrade buildah-debugsourceUpgrade conmonUpgrade conmon-debugsourceUpgrade podman-testsUpgrade slirp4netnsUpgrade criu-libsUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade criuUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade toolboxUpgrade python3-podman | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade skopeoUpgrade containers-commonUpgrade podmanUpgrade python3-criuUpgrade criu-libsUpgrade fuse-overlayfsUpgrade netavarkUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade buildah-testsUpgrade aardvark-dnsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade udicaUpgrade runcUpgrade podman-gvproxyUpgrade skopeo-testsUpgrade python3-podmanUpgrade libslirpUpgrade podman-catatonitUpgrade crunUpgrade criu-develUpgrade slirp4netnsUpgrade python-podman-apiUpgrade critUpgrade criuUpgrade podman-testsUpgrade podman-dockerUpgrade container-selinuxUpgrade conmonUpgrade podman-pluginsUpgrade cockpit-podman | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade containernetworking-pluginsUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade cockpit-podmanUpgrade runcUpgrade aardvark-dnsUpgrade containers-commonUpgrade criu-develUpgrade critUpgrade buildah-testsUpgrade criu-libs-debuginfoUpgrade python-podman-apiUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade runc-debugsourceUpgrade conmon-debuginfoUpgrade udicaUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade podman-debugsourceUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade podman-plugins-debuginfoUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade container-selinuxUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade python3-criuUpgrade netavarkUpgrade crun-debuginfoUpgrade podmanUpgrade criuUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade crunUpgrade podman-gvproxyUpgrade libslirp-develUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-testsUpgrade toolbox-testsUpgrade podman-dockerUpgrade buildah-debugsourceUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade libslirpUpgrade podman-catatonitUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade criu-libsUpgrade buildah-debuginfoUpgrade toolboxUpgrade python3-podmanUpgrade skopeo | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade podman-gvproxyUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade conmonUpgrade criu-develUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade toolbox-testsUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade criuUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade libslirpUpgrade skopeo-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade crunUpgrade slirp4netnsUpgrade toolboxUpgrade skopeoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonitUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade criu-libsUpgrade podman-debuginfoUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade podman-remoteUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade criu-libs-debuginfoUpgrade containers-commonUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade critUpgrade runcUpgrade fuse-overlayfsUpgrade buildahUpgrade conmon-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade aardvark-dnsUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade crun-debugsource | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade podman-dockerUpgrade podmanUpgrade podman-cni-configUpgrade podman-remote | Jan 30, 2023 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub