Elevated Capabilities Vulnerability in Moby (Docker Engine) Prior to Version 20.10.14
Summary
CVE-2022-24769: Moby is an open-source project created by Docker to enable and accelerate software containerization. Affects containerd across 4 version ranges.
< 1.4.13~ds1-1~deb11u2
< 2bbc786e4c59761d722d2d1518cd0a32829bc07f
< 87a90dc786bda134c9eb02adbae2c6a7342fb7f6
< a916309fff0f838eb94e928713dbc3c0d0ac7aa4
Fixed in 1.4.13~ds1-1~deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moby is an open-source project initiated by Docker to facilitate and enhance software containerization. It provides a framework for creating and managing containers, which are lightweight, portable, and self-sufficient units that can run applications in isolation. Moby's architecture allows developers to build applications that can be easily deployed across various environments. However, prior to version 20.10.14, Moby had a vulnerability that affected the security of containers by allowing improper handling of Linux process capabilities.
Vulnerability Detail
A bug was identified in Moby (Docker Engine) that caused containers to start with non-empty inheritable Linux process capabilities. This anomaly created an atypical Linux environment, enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execution. As a result, unprivileged users and processes could gain elevated permissions, particularly impacting containers that utilized Linux users and groups for privilege separation. Although the container security sandbox was not compromised, the potential for privilege escalation posed a significant risk.
How To Fix
Minimum fixed version
1.4.13~ds1-1~deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade containerdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, modify the entry point of the container to utilize the capsh(1) utility. This utility can drop inheritable capabilities before the primary process starts, thereby mitigating the risk associated with the vulnerability. An example command to drop inheritable capabilities could look like this: capsh --drop=cap_sys_admin -- -c 'your_command_here'.
Conclusion
The vulnerability in Moby (Docker Engine) prior to version 20.10.14 poses a significant risk by allowing unprivileged users to gain elevated capabilities. It is crucial for users to upgrade to the latest version and implement the recommended workaround if immediate upgrades are not feasible. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for containerd →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
All versions of Moby (Docker Engine) prior to version 20.10.14 are affected by this vulnerability.
The vulnerability allows unprivileged users and processes to gain elevated permissions, which could lead to unauthorized access and control over containerized applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If immediate upgrading is not possible, implement the suggested workaround by modifying the entry point of your containers to drop inheritable capabilities.
Related vulnerabilities
Recent vulnerabilities recorded for containerd.
