Upstream information
CVE-2022-27650 at MITRE
Description
A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having important severity.
CVSS v2 Scores
| | National Vulnerability Database |
|---|
| Base Score | 6 |
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | Single |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
CVSS v3 Scores
| | National Vulnerability Database |
|---|
| Base Score | 7.5 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | High |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3.1 |
SUSE Bugzilla entry:
1197871 [NEW]
No SUSE Security Announcements cross referenced.
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|
| SUSE Liberty Linux 8 | aardvark-dns >= 1.0.1-27.module+el8.6.0+14673+621cb8bebuildah >= 1.24.2-4.module+el8.6.0+14673+621cb8bebuildah-tests >= 1.24.2-4.module+el8.6.0+14673+621cb8becockpit-podman >= 43-1.module+el8.6.0+14673+621cb8beconmon >= 2.1.0-1.module+el8.6.0+14673+621cb8becontainer-selinux >= 2.179.1-1.module+el8.6.0+14673+621cb8becontainernetworking-plugins >= 1.0.1-2.module+el8.6.0+14673+621cb8becontainers-common >= 1.2.4-1.module+el8.6.0+14694+4f5132e0crit >= 3.15-3.module+el8.6.0+14673+621cb8becriu >= 3.15-3.module+el8.6.0+14673+621cb8becriu-devel >= 3.15-3.module+el8.6.0+14673+621cb8becriu-libs >= 3.15-3.module+el8.6.0+14673+621cb8becrun >= 1.4.4-1.module+el8.6.0+14673+621cb8befuse-overlayfs >= 1.8.2-1.module+el8.6.0+14673+621cb8belibslirp >= 4.4.0-1.module+el8.6.0+14673+621cb8belibslirp-devel >= 4.4.0-1.module+el8.6.0+14673+621cb8benetavark >= 1.0.1-27.module+el8.6.0+14673+621cb8beoci-seccomp-bpf-hook >= 1.2.3-3.module+el8.6.0+14673+621cb8bepodman >= 4.0.2-6.module+el8.6.0+14673+621cb8bepodman-catatonit >= 4.0.2-6.module+el8.6.0+14673+621cb8bepodman-docker >= 4.0.2-6.module+el8.6.0+14673+621cb8bepodman-gvproxy >= 4.0.2-6.module+el8.6.0+14673+621cb8bepodman-plugins >= 4.0.2-6.module+el8.6.0+14673+621cb8bepodman-remote >= 4.0.2-6.module+el8.6.0+14673+621cb8bepodman-tests >= 4.0.2-6.module+el8.6.0+14673+621cb8bepython3-criu >= 3.15-3.module+el8.6.0+14673+621cb8bepython3-podman >= 4.0.0-1.module+el8.6.0+14673+621cb8berunc >= 1.0.3-2.module+el8.6.0+14673+621cb8beskopeo >= 1.6.1-2.module+el8.6.0+14673+621cb8beskopeo-tests >= 1.6.1-2.module+el8.6.0+14673+621cb8beslirp4netns >= 1.1.8-2.module+el8.6.0+14673+621cb8betoolbox >= 0.0.99.3-1.module+el8.6.0+14694+4f5132e0toolbox-tests >= 0.0.99.3-1.module+el8.6.0+14694+4f5132e0udica >= 0.2.6-2.module+el8.6.0+14673+621cb8be
| Patchnames:
RHSA-2022:1762
RHSA-2022:1793 |
| SUSE Linux Micro 6.0 | | Patchnames:
SUSE Linux Micro 6.0 GA crun-1.14-1.18 |
| SUSE Linux Micro 6.1 | crun >= 1.15-slfo.1.1_1.3
| Patchnames:
SUSE Linux Micro 6.1 GA crun-1.15-slfo.1.1_1.3 |
| openSUSE Tumbleweed | | Patchnames:
openSUSE-Tumbleweed-2024-11989 |
SUSE Timeline for this CVE
CVE page created: Wed Mar 30 18:00:33 2022
CVE page last modified: Tue Dec 17 18:04:22 2024
