A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cockpit-podmanUpgrade buildahUpgrade slirp4netnsUpgrade container-selinuxUpgrade podman-dockerUpgrade python-podman-apiUpgrade python3-criuUpgrade udicaUpgrade podman-testsUpgrade aardvark-dnsUpgrade libslirpUpgrade podman-gvproxyUpgrade critUpgrade toolbox-testsUpgrade buildah-testsUpgrade podman-pluginsUpgrade criuUpgrade skopeo-testsUpgrade python3-podmanUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade runcUpgrade podman-remoteUpgrade skopeoUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade podman-catatonitUpgrade criu-develUpgrade libslirp-develUpgrade fuse-overlayfsUpgrade toolboxUpgrade netavarkUpgrade crunUpgrade podmanUpgrade criu-libs | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade podman-testsUpgrade crun-debuginfoUpgrade conmonUpgrade python3-podmanUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade skopeo-debugsourceUpgrade crunUpgrade python-podman-apiUpgrade conmon-debuginfoUpgrade toolboxUpgrade netavarkUpgrade buildah-debugsourceUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade podman-catatonit-debuginfoUpgrade criu-develUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debugsourceUpgrade podman-dockerUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade toolbox-debuginfoUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade libslirp-develUpgrade udicaUpgrade podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade toolbox-debugsourceUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade runcUpgrade criu-debuginfoUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade python3-criuUpgrade podman-debuginfoUpgrade crun-debugsourceUpgrade criuUpgrade containers-commonUpgrade buildahUpgrade aardvark-dnsUpgrade buildah-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade critUpgrade podman-catatonitUpgrade podman-remote-debuginfoUpgrade podman-debugsourceUpgrade criu-debugsourceUpgrade skopeoUpgrade runc-debugsourceUpgrade podman-remoteUpgrade fuse-overlayfs-debugsource | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade libslirpUpgrade aardvark-dnsUpgrade buildah-testsUpgrade cockpit-podmanUpgrade libslirp-develUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade podman-dockerUpgrade criu-develUpgrade critUpgrade buildahUpgrade container-selinuxUpgrade podman-testsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade python-podman-apiUpgrade python3-criuUpgrade skopeo-testsUpgrade skopeoUpgrade runcUpgrade udicaUpgrade netavarkUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade crunUpgrade containernetworking-pluginsUpgrade python3-podmanUpgrade podman-catatonitUpgrade containers-commonUpgrade criuUpgrade podmanUpgrade conmonUpgrade podman-plugins | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade critUpgrade podman-gvproxyUpgrade podman-plugins-debuginfoUpgrade crun-debuginfoUpgrade buildah-debuginfoUpgrade udicaUpgrade criu-libs-debuginfoUpgrade aardvark-dnsUpgrade skopeo-debugsourceUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade podman-debugsourceUpgrade cockpit-podmanUpgrade podman-debuginfoUpgrade runc-debugsourceUpgrade runcUpgrade podman-remoteUpgrade criu-debugsourceUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade toolbox-debuginfoUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade buildahUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade container-selinuxUpgrade slirp4netnsUpgrade toolbox-testsUpgrade python-podman-apiUpgrade podman-gvproxy-debuginfoUpgrade criu-libsUpgrade python3-criuUpgrade fuse-overlayfs-debuginfoUpgrade crun-debugsourceUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade podman-testsUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-develUpgrade python3-podmanUpgrade skopeo-testsUpgrade containers-commonUpgrade podmanUpgrade crunUpgrade criuNo solution existsUpgrade podman-catatonit-debuginfoUpgrade conmonUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade containernetworking-pluginsUpgrade skopeoUpgrade netavarkUpgrade buildah-tests-debuginfo | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade buildahUpgrade libslirpUpgrade slirp4netns-debuginfoUpgrade conmonUpgrade podman-catatonitUpgrade toolbox-testsUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-debugsourceUpgrade slirp4netns-debugsourceUpgrade toolbox-debugsourceUpgrade podman-testsUpgrade netavarkUpgrade conmon-debuginfoUpgrade criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfsUpgrade crunUpgrade podman-debugsourceUpgrade skopeo-debuginfoUpgrade toolboxUpgrade containernetworking-plugins-debuginfoUpgrade buildah-testsUpgrade podman-gvproxyUpgrade podman-pluginsUpgrade libslirp-debugsourceUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debugsourceUpgrade podmanUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade buildah-debugsourceUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade python3-criuUpgrade critUpgrade criu-develUpgrade podman-catatonit-debuginfoUpgrade criu-libsUpgrade libslirp-develUpgrade criu-debugsourceUpgrade podman-remoteUpgrade crun-debugsourceUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfo | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub