A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade critUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade podman-gvproxyUpgrade buildah-testsUpgrade podman-catatonitUpgrade buildahUpgrade udicaUpgrade python-podman-apiUpgrade criuUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade runcUpgrade netavarkUpgrade podman-testsUpgrade conmonUpgrade python3-criuUpgrade libslirpUpgrade aardvark-dnsUpgrade podmanUpgrade libslirp-develUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade crunUpgrade python3-podmanUpgrade criu-develUpgrade skopeo-testsUpgrade podman-remoteUpgrade criu-libsUpgrade skopeoUpgrade container-selinux | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade podman | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade skopeoUpgrade criuUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade slirp4netnsUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade criu-libsUpgrade podman-catatonitUpgrade conmonUpgrade conmon-debugsourceUpgrade podman-testsUpgrade toolboxUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade criu-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debuginfoUpgrade skopeo-debugsourceUpgrade buildahUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade buildah-tests-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade skopeo-debuginfoUpgrade skopeo-testsUpgrade conmon-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade podman-gvproxyUpgrade critUpgrade buildah-testsUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade podman-remoteUpgrade crun-debuginfoUpgrade udicaUpgrade crunUpgrade container-selinuxUpgrade aardvark-dnsUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade cockpit-podmanUpgrade podman-debugsourceUpgrade podman-plugins-debuginfoUpgrade python-podman-apiUpgrade slirp4netns-debuginfoUpgrade podman-dockerUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-develUpgrade criu-libs-debuginfoUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hook-debugsource | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade libpod | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade podman-testsUpgrade python3-podmanUpgrade libslirpUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade conmonUpgrade podman-pluginsUpgrade skopeo-testsUpgrade container-selinuxUpgrade criu-develUpgrade python-podman-apiUpgrade critUpgrade podman-dockerUpgrade crunUpgrade criuUpgrade runcUpgrade udicaUpgrade python3-criuUpgrade buildahUpgrade netavarkUpgrade criu-libsUpgrade buildah-testsUpgrade containers-commonUpgrade podmanUpgrade aardvark-dnsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade skopeo | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade python3-criuUpgrade toolbox-debugsourceUpgrade criu-libs-debuginfoUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade python-podman-apiUpgrade runc-debugsourceUpgrade conmon-debuginfoUpgrade podman-debugsourceUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade crun-debugsourceUpgrade libslirp-debuginfoUpgrade buildahUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade podman-remoteUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade cockpit-podmanUpgrade udicaUpgrade toolbox-debuginfoUpgrade containernetworking-pluginsUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade containernetworking-plugins-debuginfoUpgrade criu-debugsourceUpgrade critUpgrade buildah-testsUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade slirp4netnsUpgrade podmanUpgrade libslirp-develUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade python3-podmanUpgrade criu-libsUpgrade crunUpgrade netavarkUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade podman-testsUpgrade buildah-tests-debuginfoUpgrade toolbox-testsUpgrade skopeo-debuginfoUpgrade podman-remote-debuginfoUpgrade skopeoUpgrade conmonUpgrade buildah-debuginfoUpgrade toolboxUpgrade podman-dockerUpgrade conmon-debugsourceUpgrade libslirpUpgrade podman-gvproxyUpgrade crun-debuginfoUpgrade skopeo-debugsource | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade podman-catatonitUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crunUpgrade toolboxUpgrade podmanUpgrade criuUpgrade slirp4netns-debuginfoUpgrade podman-testsUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade skopeo-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-debuginfoUpgrade aardvark-dnsUpgrade podman-remote-debuginfoUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade crun-debugsourceUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade toolbox-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade runcUpgrade buildahUpgrade runc-debugsourceUpgrade podman-remoteUpgrade python3-criuUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade conmon-debugsourceUpgrade podman-plugins-debuginfoUpgrade critUpgrade buildah-testsUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade toolbox-testsUpgrade slirp4netnsUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade libslirp-debugsourceUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade netavarkUpgrade criu-develUpgrade skopeo-debuginfo | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade podmanUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-cni-config | Jan 30, 2023 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub