CVE-2022-27650

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	crun	Affects crun v1.4.3 and prior, Fixed in – v1.4.4

References

https://bugzilla.redhat.com/show_bug.cgi?id=2066845Issue Tracking, Third Party Advisory
https://github.com/containers/crun/commit/1aeeed2e4fdeffb4875c0d0b439915894594c8c6Patch, Third Party Advisory
https://github.com/containers/crun/security/advisories/GHSA-wr4f-w546-m398Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYIGABCZ7ZHAG2XCOGITTQRJU2ASWMFA/
https://bugzilla.redhat.com/show_bug.cgi?id=2066845Issue Tracking, Third Party Advisory
https://github.com/containers/crun/commit/1aeeed2e4fdeffb4875c0d0b439915894594c8c6Patch, Third Party Advisory
https://github.com/containers/crun/security/advisories/GHSA-wr4f-w546-m398Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYIGABCZ7ZHAG2XCOGITTQRJU2ASWMFA/

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-276516.8A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker En CVE-2022-276525.3A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (CVE-2022-276537.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write pa CVE-2022-276546.5When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - versi CVE-2022-276556.5When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version CVE-2022-276566.1The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled in CVE-2022-276572.7A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient v CVE-2022-276587.5Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information CVE-2022-276594.3On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated a CVE-2022-27669.8A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown fu CVE-2022-276607.5A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially CVE-2022-276614.3Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the d