QwikSec

Security Database

CVE

CWE

Training

CVE-2022-27650

Published: Apr 4, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Vendor	Product	Versions
n/a	crun	affected `Affects crun v1.4.3 and prior, Fixed in – v1.4.4`

Weaknesses (CWE)

References

https://bugzilla.redhat.com/show_bug.cgi?id=2066845

x_refsource_MISC

https://github.com/containers/crun/security/advisories/GHSA-wr4f-w546-m398

x_refsource_MISC

https://github.com/containers/crun/commit/1aeeed2e4fdeffb4875c0d0b439915894594c8c6

x_refsource_MISC

FEDORA-2022-10fd054d40

vendor-advisory

x_refsource_FEDORA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.