CVE-2022-27652
Fixed in a distro release EPSS <1%
A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
Products: kubernetes cri-o, fedoraproject fedora, mobyproject moby, redhat openshift_container_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.24.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.10 | cri-o | 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 |
| Red Hat openshift 4.10 | cri-o-debugsource | 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1650890594-1.el8 |
| Red Hat openshift 4.9 | cri-o | 0:1.22.5-7.rhaos4.9.git3dbcd3c.el7 |
| Red Hat openshift 4.9 | cri-o | 0:1.22.5-7.rhaos4.9.git3dbcd3c.el8 |
| Red Hat openshift 4.9 | cri-o-debuginfo | 0:1.22.5-7.rhaos4.9.git3dbcd3c.el7 |
| Red Hat openshift 4.9 | cri-o-debuginfo | 0:1.22.5-7.rhaos4.9.git3dbcd3c.el8 |
| Red Hat openshift 4.9 | cri-o-debugsource | 0:1.22.5-7.rhaos4.9.git3dbcd3c.el8 |