7.8

CVE-2022-29162: Incorrect Default Permissions in runc

Modified
AliasesMGASA-2022-0192RHSA-2022:8090UBUNTU-CVE-2022-29162
Published 17-05-2022Last modified 23-04-2025
Some data may be incomplete
  • 1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2022-29162 is a high (CVSS 7.8) Incorrect Default Permissions vulnerability in fedoraproject fedora. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 33.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.9, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 11
DLA-3369-1OPENSUSE-SU-2024:12074-1OPENSUSE-SU-2025:15424-1RHSA-2022:5068RHSA-2022:7457RHSA-2022:7469

Timeline

  1. 17-05-2022
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

CVSS metrics

10 scores · 9 sources · 2 versions

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

34%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.39% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard5 products
  • ctop< 0.7.7-r13
  • podman< 5.2.2-r1
  • podman-doc< 5.2.2-r1
  • runcAll versions (No fix recorded)
  • runc-docAll versions (No fix recorded)
Wolfi5 products
  • ctop< 0.7.7-r13
  • podman< 5.2.2-r1
  • podman-doc< 5.2.2-r1
  • runcAll versions (No fix recorded)
  • runc-docAll versions (No fix recorded)
Redhat3 products
  • runc< 4:1.1.4-1.el9
  • runc-debuginfo< 4:1.1.4-1.el9
  • runc-debugsource< 4:1.1.4-1.el9
Alpine1 product
  • runc< 1.1.2-r0
Debian1 product
  • runc< 1.1.3+ds1-1
Fedoraproject1 product
Github.com/opencontainers1 product
  • runc< 1.1.2
Linuxfoundation1 product
Mageia1 product
  • opencontainers-runc< 1.1.2-2.mga8
Opencontainers1 product
Ubuntu1 product
  • runc< 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4

11 vendors · 21 products

References

27 links
Show all 27 references