[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 May 2022 15:28:23 +1000
From: Aleksa Sarai <asarai@...e.de>
To: security-announce@...ncontainers.org, oss-security@...ts.openwall.com
Subject: CVE-2022-29162: runc < 1.1.2 incorrect handling of inheritable
capabilities in default configuration
A security update for runc (v1.1.2) was released to mitigate
CVE-2022-29162, which is a low severity vulnerability related to
mishandling of inheritable capabilities which resulted in an atypical
Linux environment inside containers.
As the inheritable set was a subset of the permitted capabilities (which
are limited) this bug does not affect the container security boundary,
it simply ensures that programs running inside the container do not
inherit capabilities they do not need accidentally. This issue is
similar to CVE-2022-24769 which was found in Docker and containerd.
As this issue was deemed not exploitable, there is no embargo for this
patch and release. Please update as soon as practical.
You can find the new version of runc on our releases page[1] and the
patch fixing the issue is [2].
[1]: https://github.com/opencontainers/runc/releases/tag/v1.1.2
[2]: https://github.com/opencontainers/runc/commit/98fe566c527479195ce3c8167136d2a555fe6b65
--
Aleksa Sarai
Senior Software Engineer (Containers)
SUSE Linux GmbH
<https://www.cyphar.com/>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
