CVE-2022-27651

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-27651
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:N

Exploitability : 6.8 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2066840 Issue Tracking Third Party Advisory
https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b Patch Third Party Advisory
https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/
Configurations

Configuration 1 (hide)

cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
History

03 Sep 2022, 03:56

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/ - Mailing List, Third Party Advisory

07 May 2022, 07:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/ -

13 Apr 2022, 15:23

Type Values Removed Values Added
References (MISC) https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b - (MISC) https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b - Patch, Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2066840 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2066840 - Issue Tracking, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/ - Mailing List, Third Party Advisory
References (MISC) https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h - (MISC) https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/ - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : 4.9
v3 : 6.8
CWE CWE-276
CPE cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

07 Apr 2022, 17:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/ -

04 Apr 2022, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-04-04 20:15

Updated : 2024-02-04 22:29

NVD link : CVE-2022-27651

Mitre link : CVE-2022-27651

CVE.ORG link : CVE-2022-27651

JSON object : View

Products Affected

fedoraproject

  • fedora

redhat

  • enterprise_linux

buildah_project

  • buildah
CWE
CWE-276

Incorrect Default Permissions