A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade container-selinuxUpgrade buildah-testsUpgrade critUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade podman-dockerUpgrade udicaUpgrade podman-testsUpgrade podman-gvproxyUpgrade python-podman-apiUpgrade python3-criuUpgrade buildahUpgrade runcUpgrade skopeoUpgrade podman-catatonitUpgrade skopeo-testsUpgrade crunUpgrade conmonUpgrade podman-remoteUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade netavarkUpgrade podmanUpgrade criuUpgrade toolboxUpgrade criu-develUpgrade criu-libsUpgrade fuse-overlayfs | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade conmonUpgrade skopeo-testsUpgrade conmon-debuginfoUpgrade podman-testsUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade netavarkUpgrade toolboxUpgrade conmon-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade slirp4netnsUpgrade toolbox-testsUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python-podman-apiUpgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade buildah-debugsourceUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade criu-develUpgrade skopeo-debugsourceUpgrade libslirpUpgrade containernetworking-plugins-debuginfoUpgrade python3-podmanUpgrade skopeo-debuginfoUpgrade slirp4netns-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-criuUpgrade podman-debuginfoUpgrade aardvark-dnsUpgrade buildahUpgrade crun-debugsourceUpgrade podman-catatonitUpgrade podman-debugsourceUpgrade criuUpgrade buildah-debuginfoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade buildah-testsUpgrade toolbox-debuginfoUpgrade udicaUpgrade criu-debugsourceUpgrade skopeoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debugsourceUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade container-selinuxUpgrade critUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade podmanUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade runcUpgrade runc-debuginfo | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade netavarkUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade skopeoUpgrade criuUpgrade python3-podmanUpgrade containers-commonUpgrade crunUpgrade udicaUpgrade runcUpgrade podman-catatonitUpgrade podman-pluginsUpgrade conmonUpgrade podmanUpgrade container-selinuxUpgrade podman-dockerUpgrade libslirp-develUpgrade buildahUpgrade slirp4netnsUpgrade python3-criuUpgrade podman-testsUpgrade python-podman-apiUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade buildah-testsUpgrade criu-develUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade crit | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade podman-remoteUpgrade conmon-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade libslirp-debuginfoUpgrade python-podman-apiUpgrade slirp4netnsUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade python3-criuUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-dockerUpgrade udicaUpgrade criu-libsUpgrade container-selinuxUpgrade slirp4netns-debuginfoUpgrade buildahUpgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade skopeo-debugsourceUpgrade cockpit-podmanUpgrade runcUpgrade podman-gvproxyUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade skopeo-debuginfoUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade critUpgrade containers-commonUpgrade crunUpgrade podman-remote-debuginfoUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade toolbox-debugsourceUpgrade buildah-debugsourceUpgrade buildah-tests-debuginfoUpgrade python3-podmanUpgrade podmanNo solution existsUpgrade criuUpgrade skopeoUpgrade libslirpUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-develUpgrade criu-debuginfoUpgrade conmonUpgrade podman-testsUpgrade podman-catatonitUpgrade crun-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade toolboxUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade conmon-debugsourceUpgrade criu-devel | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade podmanUpgrade containers-commonUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade conmon-debugsourceUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade podman-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade criu-libsUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade aardvark-dnsUpgrade critUpgrade criu-develUpgrade python3-criuUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade buildah-tests-debuginfoUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade podman-remote-debuginfoUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-testsUpgrade podman-pluginsUpgrade buildahUpgrade conmon-debuginfoUpgrade libslirpUpgrade toolbox-testsUpgrade criuUpgrade slirp4netns-debuginfoUpgrade conmonUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade crunUpgrade netavarkUpgrade fuse-overlayfsUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade slirp4netnsUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonitUpgrade skopeo-debuginfo | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub