Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-27649

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Published

2022-04-04T20:15:10.890

Last Modified

2024-11-21T06:56:05.923

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

6.8

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-276
Type: Primary
CWE-276

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	podman_project	podman	< 4.0.3	Yes
Application	redhat	developer_tools	1.0	Yes
Application	redhat	openshift_container_platform	4.0	Yes
Operating System	redhat	enterprise_linux	8.0	Yes
Operating System	redhat	enterprise_linux	8.6	Yes
Operating System	redhat	enterprise_linux_eus	8.4	Yes
Operating System	redhat	enterprise_linux_eus	8.6	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	8.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	8.6	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems_eus	8.4	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems_eus	8.6	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	8.0	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian_eus	8.4	Yes
Operating System	redhat	enterprise_linux_server_aus	8.4	Yes
Operating System	redhat	enterprise_linux_server_aus	8.6	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.4	Yes
Operating System	redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	8.6	Yes
Operating System	redhat	enterprise_linux_server_tus	8.4	Yes
Operating System	redhat	enterprise_linux_server_tus	8.6	Yes
Operating System	redhat	enterprise_linux_server_update_services_for_sap_solutions	8.4	Yes
Operating System	redhat	enterprise_linux_server_update_services_for_sap_solutions	8.6	Yes
Operating System	fedoraproject	fedora	34	Yes
Operating System	fedoraproject	fedora	35	Yes
Operating System	fedoraproject	fedora	36	Yes

References

https://bugzilla.redhat.com/show_bug.cgi?id=2066568 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0 Patch, Third Party Advisory ([email protected])
https://github.com/containers/podman/security/advisories/GHSA-qvf8-p83w-v58j Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/ ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2066568 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/containers/podman/security/advisories/GHSA-qvf8-p83w-v58j Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/ (af854a3a-2127-422b-91ae-364da2661108)