Vulnerability Description
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Buildah Project | Buildah | < 1.25.0 |
| Fedoraproject | Fedora | 34 |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2066840Issue TrackingThird Party Advisory
- https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfPatchThird Party Advisory
- https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7hThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://bugzilla.redhat.com/show_bug.cgi?id=2066840Issue TrackingThird Party Advisory
- https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfPatchThird Party Advisory
- https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7hThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-27651?
CVE-2022-27651 is a vulnerability with a CVSS score of 6.8 (MEDIUM). A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-emp...
How severe is CVE-2022-27651?
CVE-2022-27651 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-27651?
Check the references section above for vendor advisories and patch information. Affected products include: Buildah Project Buildah, Fedoraproject Fedora, Redhat Enterprise Linux.