Vulnerability Description
A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Crun Project | Crun | < 1.4.4 |
| Fedoraproject | Fedora | 34 |
| Redhat | Openshift Container Platform | 4.0 |
| Redhat | Enterprise Linux | 8.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2066845Issue TrackingThird Party Advisory
- https://github.com/containers/crun/commit/1aeeed2e4fdeffb4875c0d0b439915894594c8PatchThird Party Advisory
- https://github.com/containers/crun/security/advisories/GHSA-wr4f-w546-m398Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://bugzilla.redhat.com/show_bug.cgi?id=2066845Issue TrackingThird Party Advisory
- https://github.com/containers/crun/commit/1aeeed2e4fdeffb4875c0d0b439915894594c8PatchThird Party Advisory
- https://github.com/containers/crun/security/advisories/GHSA-wr4f-w546-m398Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-27650?
CVE-2022-27650 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with ...
How severe is CVE-2022-27650?
CVE-2022-27650 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-27650?
Check the references section above for vendor advisories and patch information. Affected products include: Crun Project Crun, Fedoraproject Fedora, Redhat Openshift Container Platform, Redhat Enterprise Linux.