A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade udicaUpgrade cockpit-podmanUpgrade podman-remoteUpgrade toolbox-testsUpgrade runcUpgrade critUpgrade podmanUpgrade podman-catatonitUpgrade buildahUpgrade netavarkUpgrade python3-podmanUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade podman-testsUpgrade slirp4netnsUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade criuUpgrade podman-dockerUpgrade libslirpUpgrade toolboxUpgrade conmonUpgrade containernetworking-pluginsUpgrade criu-develUpgrade libslirp-develUpgrade criu-libsUpgrade podman-pluginsUpgrade python3-criuUpgrade container-selinuxUpgrade skopeoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade crun | May 13, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade crun | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade runc-debuginfoUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade criu-develUpgrade python3-podmanUpgrade skopeoUpgrade libslirpUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-debuginfoUpgrade slirp4netnsUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade netavarkUpgrade skopeo-testsUpgrade criu-libs-debuginfoUpgrade podmanUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade udicaUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade libslirp-debugsourceUpgrade conmonUpgrade toolboxUpgrade slirp4netns-debuginfoUpgrade containers-commonUpgrade conmon-debugsourceUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade criuUpgrade toolbox-testsUpgrade podman-remoteUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade fuse-overlayfsUpgrade critUpgrade criu-libsUpgrade criu-debuginfoUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade buildahUpgrade toolbox-debuginfoUpgrade podman-plugins-debuginfoUpgrade skopeo-debugsourceUpgrade python3-criuUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonitUpgrade fuse-overlayfs-debugsourceUpgrade buildah-testsUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade conmon-debuginfoUpgrade runc-debugsourceUpgrade runcUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook | May 13, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade crun | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade podman-gvproxyUpgrade skopeo-testsUpgrade podman-pluginsUpgrade criu-develUpgrade python3-criuUpgrade critUpgrade runcUpgrade udicaUpgrade container-selinuxUpgrade podman-remoteUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade crunUpgrade slirp4netnsUpgrade podman-testsUpgrade conmonUpgrade libslirpUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade fuse-overlayfsUpgrade criuUpgrade buildahUpgrade cockpit-podmanUpgrade python3-podmanUpgrade aardvark-dnsUpgrade podman-dockerUpgrade criu-libsUpgrade containers-commonUpgrade skopeoUpgrade podman-catatonitUpgrade podman | May 18, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-libsUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade container-selinuxUpgrade toolbox-debuginfoUpgrade crunUpgrade skopeo-testsUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade crun-debuginfoUpgrade podman-remote-debuginfoUpgrade libslirp-debuginfoUpgrade libslirpUpgrade podman-debugsourceUpgrade python3-criuUpgrade criu-develUpgrade toolbox-debugsourceUpgrade podman-gvproxyUpgrade toolboxUpgrade conmonUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade podman-debuginfoUpgrade skopeo-debugsourceUpgrade netavarkUpgrade podman-testsUpgrade cockpit-podmanUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade podman-dockerUpgrade critUpgrade skopeoUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade runcUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade toolbox-testsUpgrade criuUpgrade buildah-testsUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-catatonitUpgrade conmon-debugsourceUpgrade python3-podmanUpgrade skopeo-debuginfoUpgrade podmanUpgrade udica | May 13, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade podman-remoteUpgrade runc-debuginfoUpgrade conmon-debuginfoUpgrade runcUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade criu-develUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-debugsourceUpgrade python3-criuUpgrade skopeo-testsUpgrade containers-commonUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debuginfoUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade crun-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade crunUpgrade libslirpUpgrade criu-libs-debuginfoUpgrade toolboxUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade conmonUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade skopeoUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade buildah-tests-debuginfoUpgrade netavarkUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade buildahUpgrade podmanUpgrade skopeo-debuginfoUpgrade buildah-debuginfoUpgrade slirp4netnsUpgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade toolbox-tests | Mar 5, 2024 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub