CVE-2022-29162mediumCWE-276

CVE-2022-29162: fallo de gravedad media en opencontainers runc

Incorrect Default Permissions in runc

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear runc+ Monitorear runc

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.4%
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
opencontainers · runc
CVEs relacionadas — opencontainers runc

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-21626HIGHrunc container breakout through process.cwd trickery and leaked fdsEPSS 18.9%CVE-2021-43784MEDIUMOverflow in netlink bytemsg length field allows attacker to override netlink-based container configurationEPSS 1.8%CVE-2025-31133HIGHrunc container escape via "masked path" abuse due to mount race conditionsEPSS 1.2%CVE-2025-52565HIGHcontainer escape due to /dev/console mount and related racesEPSS 0.8%CVE-2025-52881HIGHrunc: LSM labels can be bypassed with malicious config using dummy procfs filesEPSS 0.8%CVE-2023-28642MEDIUMAppArmor bypass with symlinked /proc in runcEPSS 0.3%