A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containers-commonUpgrade python3-criuUpgrade podman-pluginsUpgrade crunUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade skopeo-testsUpgrade libslirp-develUpgrade criu-libsUpgrade container-selinuxUpgrade criu-develUpgrade containernetworking-pluginsUpgrade skopeoUpgrade criuUpgrade critUpgrade udicaUpgrade podman-testsUpgrade libslirpUpgrade podman-dockerUpgrade toolbox-testsUpgrade netavarkUpgrade buildahUpgrade runcUpgrade podmanUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade podman-remoteUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade python3-podman | May 13, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade crun | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade criu-libsUpgrade criuUpgrade podman-plugins-debuginfoUpgrade toolbox-testsUpgrade podman-gvproxy-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade buildah-testsUpgrade python3-criuUpgrade skopeo-debugsourceUpgrade toolbox-debuginfoUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade criu-debuginfoUpgrade container-selinuxUpgrade libslirp-develUpgrade buildahUpgrade critUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade podman-debuginfoUpgrade runcUpgrade runc-debugsourceUpgrade podman-catatonitUpgrade podman-dockerUpgrade fuse-overlayfs-debuginfoUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade libslirp-debugsourceUpgrade slirp4netnsUpgrade containernetworking-plugins-debuginfoUpgrade conmonUpgrade udicaUpgrade podman-remote-debuginfoUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade python3-podmanUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade crunUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-debuginfoUpgrade toolboxUpgrade slirp4netns-debuginfoUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade libslirpUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade criu-develUpgrade buildah-debugsource | May 13, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade crun | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade podman-remoteUpgrade critUpgrade podman-gvproxyUpgrade criu-develUpgrade container-selinuxUpgrade crunUpgrade udicaUpgrade podman-testsUpgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade slirp4netnsUpgrade podman-pluginsUpgrade runcUpgrade python3-criuUpgrade libslirp-develUpgrade skopeoUpgrade criu-libsUpgrade cockpit-podmanUpgrade buildahUpgrade podman-dockerUpgrade podmanUpgrade buildah-testsUpgrade conmonUpgrade aardvark-dnsUpgrade netavarkUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade criuUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade podman-catatonit | May 18, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade container-selinuxUpgrade containers-commonUpgrade podman-pluginsUpgrade toolbox-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade podman-debugsourceUpgrade libslirpUpgrade libslirp-debugsourceUpgrade skopeo-testsUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade criu-develUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade crun-debuginfoUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade python3-criuUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade runcUpgrade critUpgrade containernetworking-pluginsUpgrade conmonUpgrade podmanUpgrade cockpit-podmanUpgrade python3-podmanUpgrade udicaUpgrade toolbox-debugsourceUpgrade podman-testsUpgrade podman-debuginfoUpgrade skopeoUpgrade criu-debuginfoUpgrade toolbox-testsUpgrade skopeo-debugsourceUpgrade skopeo-debuginfoUpgrade criuUpgrade buildah-testsUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade toolboxUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade netavarkUpgrade criu-libs-debuginfoUpgrade podman-dockerUpgrade podman-remoteUpgrade podman-catatonitUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade criu-debugsource | May 13, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade podman-plugins-debuginfoUpgrade runcUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade python3-criuUpgrade crun-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade critUpgrade libslirp-develUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade crun-debuginfoUpgrade podman-catatonit-debuginfoUpgrade criu-develUpgrade podman-testsUpgrade crunUpgrade skopeo-testsUpgrade podman-remoteUpgrade criu-libsUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade toolbox-debuginfoUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade buildah-debuginfoUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade fuse-overlayfs-debugsourceUpgrade criu-libs-debuginfoUpgrade libslirpUpgrade netavarkUpgrade criu-debugsourceUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade conmonUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade toolboxUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade toolbox-debugsourceUpgrade skopeo-debugsourceUpgrade skopeoUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade skopeo-debuginfoUpgrade conmon-debugsourceUpgrade criuUpgrade buildahUpgrade podman | Mar 5, 2024 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub