A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2066839 | Issue Tracking Third Party Advisory |
| https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6 | Mitigation Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
27 Apr 2022, 00:22
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* cpe:2.3:a:kubernetes:cri-o:-:*:*:*:*:*:*:* |
|
| CWE | CWE-276 | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2066839 - Issue Tracking, Third Party Advisory | |
| References | (MISC) https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6 - Mitigation, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.6
v3 : 5.3 |
18 Apr 2022, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-18 17:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-27652
Mitre link : CVE-2022-27652
CVE.ORG link : CVE-2022-27652
JSON object : View
Products Affected
mobyproject
- moby
fedoraproject
- fedora
redhat
- openshift_container_platform
kubernetes
- cri-o
CWE
CWE-276
Incorrect Default Permissions