PT-2022-18549 · Cri-O+2 · Cri-O+2
Andrew G. Morgan
·
Published
2022-04-14
·
Updated
2024-08-21
·
CVE-2022-27652
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
cri-o versions prior to v1.24.0
Description
A flaw was found in cri-o where containers were incorrectly started with non-empty default permissions, allowing an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This bug creates an atypical Linux environment, enabling programs with inheritable file capabilities to elevate those capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.
Recommendations
For versions prior to v1.24.0, update to version v1.24.0 or later as soon as possible. After updating, stop, delete, and recreate running containers to reset the inheritable capabilities. As a temporary workaround, consider modifying the entrypoint of a container to use a utility like
capsh(1) to drop inheritable capabilities prior to the primary process starting.Fix
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Docker
Cri-O