Bug 2086398 (CVE-2022-29162)

Summary:	CVE-2022-29162 runc: incorrect handling of inheritable capabilities
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	amurdaca, bbaude, bmontgom, dfreiber, drow, dwalsh, eparis, gscrivan, jburrell, jchaloup, jnovy, jokerman, kolyshkin, lsm5, mpatel, nstielau, o.lemasle, pehunt, rh.container.bot, sponnaga, TicoTimo, tsweeney, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	runc 1.1.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in runc, where runc exec --cap executed processes with non-empty inheritable Linux process capabilities. This issue creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-07 03:03:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2086399, 2086400, 2092740, 2095677, 2095678, 2095679, 2095680, 2095681
Bug Blocks:	2086401

Description Sandipan Roy 2022-05-16 04:11:57 UTC

"A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set."

Please bump to 1.1.2.

https://bugs.gentoo.org/844085

Comment 1 Sandipan Roy 2022-05-16 04:13:32 UTC

Created runc tracking bugs for this issue:

Affects: fedora-34 [bug 2086400]
Affects: fedora-35 [bug 2086399]

Comment 7 errata-xmlrpc 2022-08-10 10:09:40 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11
  Ironic content for Red Hat OpenShift Container Platform 4.11

Via RHSA-2022:5068 https://access.redhat.com/errata/RHSA-2022:5068

Comment 8 errata-xmlrpc 2022-11-08 09:12:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7457 https://access.redhat.com/errata/RHSA-2022:7457

Comment 9 errata-xmlrpc 2022-11-08 09:13:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7469 https://access.redhat.com/errata/RHSA-2022:7469

Comment 10 errata-xmlrpc 2022-11-15 10:12:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8090 https://access.redhat.com/errata/RHSA-2022:8090

Comment 11 Product Security DevOps Team 2022-12-07 03:03:41 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-29162