A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade udicaUpgrade container-selinuxUpgrade podman-gvproxyUpgrade python-podman-apiUpgrade slirp4netnsUpgrade buildah-testsUpgrade critUpgrade cockpit-podmanUpgrade podman-testsUpgrade aardvark-dnsUpgrade buildahUpgrade libslirpUpgrade toolbox-testsUpgrade podman-dockerUpgrade netavarkUpgrade runcUpgrade conmonUpgrade skopeoUpgrade containers-commonUpgrade criu-libsUpgrade python3-podmanUpgrade libslirp-develUpgrade criuUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade criu-develUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade crunUpgrade toolboxUpgrade podman-pluginsUpgrade podman-remoteUpgrade skopeo-testsUpgrade fuse-overlayfs | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade conmon-debugsourceUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfsUpgrade netavarkUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade python3-podmanUpgrade skopeo-debuginfoUpgrade crun-debuginfoUpgrade podman-testsUpgrade criu-develUpgrade libslirpUpgrade toolbox-testsUpgrade conmonUpgrade crunUpgrade slirp4netnsUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade podman-pluginsUpgrade skopeo-debugsourceUpgrade slirp4netns-debugsourceUpgrade python-podman-apiUpgrade toolboxUpgrade podman-gvproxy-debuginfoUpgrade udicaUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-debugsourceUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade python3-criuUpgrade podman-debuginfoUpgrade criuUpgrade containers-commonUpgrade buildah-debuginfoUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade podmanUpgrade buildahUpgrade podman-catatonitUpgrade criu-debugsourceUpgrade skopeoUpgrade runc-debugsourceUpgrade podman-remoteUpgrade fuse-overlayfs-debugsourceUpgrade runcUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade crit | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade skopeo-testsUpgrade aardvark-dnsUpgrade criu-develUpgrade podman-gvproxyUpgrade buildah-testsUpgrade libslirp-develUpgrade podman-dockerUpgrade critUpgrade buildahUpgrade container-selinuxUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade podman-testsUpgrade libslirpUpgrade python-podman-apiUpgrade python3-criuUpgrade crunUpgrade conmonUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade udicaUpgrade netavarkUpgrade runcUpgrade podman-pluginsUpgrade podmanUpgrade skopeoUpgrade fuse-overlayfsUpgrade containers-commonUpgrade criuUpgrade podman-remote | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade conmonUpgrade criu-develUpgrade criu-debuginfoUpgrade buildah-debugsourceUpgrade python3-podmanUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade toolbox-debugsourceUpgrade toolboxUpgrade skopeo-testsUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfsNo solution existsUpgrade containernetworking-pluginsUpgrade netavarkUpgrade podmanUpgrade libslirp-develUpgrade conmon-debugsourceUpgrade crunUpgrade podman-pluginsUpgrade podman-catatonitUpgrade podman-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade slirp4netns-debugsourceUpgrade criuUpgrade skopeoUpgrade buildah-tests-debuginfoUpgrade containers-commonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runc-debuginfoUpgrade podman-gvproxyUpgrade python3-criuUpgrade udicaUpgrade critUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade container-selinuxUpgrade slirp4netns-debuginfoUpgrade podman-remoteUpgrade skopeo-debuginfoUpgrade python-podman-apiUpgrade criu-libs-debuginfoUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade skopeo-debugsourceUpgrade libslirp-debugsourceUpgrade podman-dockerUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade toolbox-testsUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade buildah-testsUpgrade conmon-debuginfoUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade toolbox-debuginfo | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade buildah-tests-debuginfoUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade criu-libsUpgrade runcUpgrade fuse-overlayfs-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade runc-debugsourceUpgrade libslirp-develUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade skopeo-testsUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade podman-remoteUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade critUpgrade containernetworking-pluginsUpgrade conmon-debugsourceUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade podman-gvproxy-debuginfoUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade criuUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolboxUpgrade crunUpgrade podman-gvproxyUpgrade skopeo-debuginfoUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade podman-pluginsUpgrade buildah-testsUpgrade podman-catatonitUpgrade toolbox-debugsourceUpgrade conmonUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-testsUpgrade libslirpUpgrade buildahUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade netavark | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub