PT-2022-6726 · Podman+7 · Podman+7

Andrew Morgan · Published 2022-04-01 · Updated 2025-08-28 · CVE-2022-27649

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Podman (affected versions not specified)

Description The issue is related to errors in using standard permissions, allowing an attacker to bypass security restrictions and elevate privileges. This is due to containers being started with non-empty default permissions and non-empty inheritable Linux process capabilities. The flaw enables programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALSA-2022:1565

ALSA-2022:1566

ALSA-2022:1762

ALT-PU-2022-1658

ALT-PU-2023-1488

ALT-PU-2025-10794

AZL-9320

BDU:2023-03753

CESA-2022_1565

CESA-2022_1566

CESA-2022_1762

CVE-2022-27649

GHSA-QVF8-P83W-V58J

GO-2022-0416

MGASA-2023-0213

OESA-2025-1073

OESA-2025-1074

OPENSUSE-SU-2023_0187-1

OPENSUSE-SU-2024:11982-1

RHSA-2022:1407

RHSA-2022:1565

RHSA-2022:1566

RHSA-2022:1762

RHSA-2022:4651

RHSA-2022:4816

RHSA-2022_1565

RHSA-2022_1566

RHSA-2022_1762

RLSA-2022:1565

RLSA-2022:1566

RLSA-2022:1762

SUSE-SU-2023:0187-1

SUSE-SU-2023:0326-1

Affected Products

Alt Linux

Almalinux

Centos

Podman

Red Hat

Red Os

Rocky Linux

Suse

References · 160

• https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-27649 · Security Note
• https://bdu.fstec.ru/vul/2023-03753 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-27649 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/XOKBC52ABMXFW242S6YAQLBUX3QPEDOR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0778 · Security Note
• https://errata.almalinux.org/8/ALSA-2022-1566.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-9320 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/75MV35CPCW3Q5MAQR6OGEJEYVVEZ2MXI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/GDWE3ABI6VTR2BO4UV3HXEUYUN5CKUES · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IKOQ2O3CAYO75ZV2PUCTL6G72K7JVGCT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0416 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6170-1 · Vendor Advisory