PT-2022-6151 · Docker+6 · Moby+7
Andrew G. Morgan
·
Published
2022-03-24
·
Updated
2025-10-11
·
CVE-2022-24769
CVSS v3.1
5.9
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Moby (Docker Engine) versions prior to 20.10.14
Description
A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during
execve(2). Containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.Recommendations
To resolve the issue, update to Moby (Docker Engine) version 20.10.14 or later.
For versions prior to 20.10.14, stop, delete, and recreate running containers to reset the inheritable capabilities.
As a temporary workaround, consider modifying the entry point of a container to use a utility like
capsh(1) to drop inheritable capabilities prior to the primary process starting.Exploit
Fix
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Docker
Kubernetes Containerd
Linuxmint
Moby
Suse
Ubuntu