Date: Thu, 12 May 2022 15:28:23 +1000 From: Aleksa Sarai <asarai@...e.de> To: security-announce@...ncontainers.org, oss-security@...ts.openwall.com Subject: CVE-2022-29162: runc < 1.1.2 incorrect handling of inheritable capabilities in default configuration A security update for runc (v1.1.2) was released to mitigate CVE-2022-29162, which is a low severity vulnerability related to mishandling of inheritable capabilities which resulted in an atypical Linux environment inside containers. As the inheritable set was a subset of the permitted capabilities (which are limited) this bug does not affect the container security boundary, it simply ensures that programs running inside the container do not inherit capabilities they do not need accidentally. This issue is similar to CVE-2022-24769 which was found in Docker and containerd. As this issue was deemed not exploitable, there is no embargo for this patch and release. Please update as soon as practical. You can find the new version of runc on our releases page and the patch fixing the issue is . : https://github.com/opencontainers/runc/releases/tag/v1.1.2 : https://github.com/opencontainers/runc/commit/98fe566c527479195ce3c8167136d2a555fe6b65 -- Aleksa Sarai Senior Software Engineer (Containers) SUSE Linux GmbH <https://www.cyphar.com/> Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.