CVE-2022-29162: Default inheritable capabilities for linux container should be empty
Summary
CVE-2022-29162: Default inheritable capabilities for linux container should be empty. Affects github.com/opencontainers/runc versions < 1.1.2. Fixed in 1.1.2. How to fix ↓
Also tracked for
- runc · Debian:11
The same CVE-2022-29162 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/opencontainers/runc, which is written in Go. Runc is a lightweight, portable container runtime that is used by various container engines and orchestrators. It provides an interface for creating and managing containers based on the Open Container Initiative (OCI) specifications. Runc allows users to execute processes within containers, providing isolation and resource management. However, a vulnerability has been discovered in runc that affects the default inheritable capabilities for Linux containers.
Vulnerability Detail
The vulnerability in runc (CVE-2022-29162) allows processes executed with non-empty inheritable Linux process capabilities. This creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Although this bug does not affect the container security sandbox, as the inheritable set never contained more capabilities than the container's bounding set, it still poses a security risk. An attacker could potentially exploit this vulnerability to gain elevated privileges within the container. The vulnerability has a CVSS score of 5.9.
How To Fix
Latest published version: v1.5.2 as of 22 Oct 2026
go get github.com/opencontainers/runc@v1.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.2
This is the first release that contains the fix.
go get github.com/opencontainers/runc@v1.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in runc (CVE-2022-29162) exposes containers to potential privilege escalation. To mitigate this risk, users should update to runc version 1.1.2 or later and ensure that the container's configuration does not include any inheritable capabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/runc →
FAQ
Runc is a lightweight, portable container runtime used by various container engines and orchestrators. It allows users to create and manage containers based on the OCI specifications.
The vulnerability allows processes within containers to have non-empty inheritable Linux process capabilities, potentially enabling privilege escalation within the container.
No, the container security sandbox is not affected by this vulnerability as the inheritable set never contained more capabilities than the container's bounding set.
To fix this vulnerability, update to runc version 1.1.2 or later and ensure that the container's configuration does not include any inheritable capabilities.
No, there is no workaround available for this vulnerability. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/opencontainers/runc.
