CVE-2022-27651 | BDVDB-2026-173213 Detail
buildah
Description#
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
Impact#
No impact statement in the source data.
Weaknesses#
- CWE-276 Incorrect Default Permissions
References#
- https://bugzilla.redhat.com/show_bug.cgi?id=2066840
- https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h
- https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.