CVE-2022-27652

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	cri-o	Affects all versions.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2066839Issue Tracking, Third Party Advisory
https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6Mitigation, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2066839Issue Tracking, Third Party Advisory
https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6Mitigation, Third Party Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-276537.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write pa CVE-2022-276546.5When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - versi CVE-2022-276556.5When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version CVE-2022-276566.1The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled in CVE-2022-276572.7A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient v CVE-2022-276587.5Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information CVE-2022-276594.3On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated a CVE-2022-27669.8A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown fu CVE-2022-276607.5A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially CVE-2022-276614.3Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the d CVE-2022-276624.8On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exi CVE-2022-276647.5In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang duri