Elevated Capability Vulnerability in runc: CVE-2022-29162
Summary
CVE-2022-29162: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. Affects runc across 3 version ranges.
< 1.0.0~rc93+ds1-5+deb11u2
< a916309fff0f838eb94e928713dbc3c0d0ac7aa4
< d04de3a9b72d7a2455c1885fc75eb36d02cd17b5
Fixed in 1.0.0~rc93+ds1-5+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a command-line interface tool designed for spawning and managing containers on Linux systems, adhering to the Open Container Initiative (OCI) specifications. It is widely used in container orchestration platforms and provides essential functionalities for container lifecycle management. The vulnerability in question affects versions of runc prior to 1.1.2, where a bug allowed processes to inherit non-empty Linux process capabilities, potentially leading to unintended privilege escalation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-29162, originates from a bug in runc that allowed the runc exec --cap command to create processes with inheritable Linux process capabilities. This created an atypical environment where programs with inheritable file capabilities could elevate their capabilities to the permitted set during the execve(2) system call. Although this bug did not compromise the container security sandbox, it posed a risk of privilege escalation within the container environment. The issue has been resolved in runc version 1.1.2, which modifies the behavior of runc exec --cap to exclude inheritable capabilities.
How To Fix
Minimum fixed version
1.0.0~rc93+ds1-5+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the runc exec --cap command until they can upgrade to a secure version. Additionally, limiting the use of inheritable capabilities in container configurations can help reduce the risk of privilege escalation.
Conclusion
CVE-2022-29162 represents a significant vulnerability in runc that could allow privilege escalation through improper handling of Linux process capabilities. Users are strongly advised to upgrade to the latest version to ensure the security of their containerized applications. Temporary workarounds are available, but upgrading is the most effective solution.
See every vulnerability recorded for runc →
FAQ
CVE-2022-29162 is a vulnerability in runc that allows processes to inherit non-empty Linux process capabilities, potentially leading to privilege escalation.
Versions of runc prior to 1.1.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-29162 is 7.8, indicating a high severity level.
If immediate upgrading is not possible, refrain from using the runc exec --cap command and limit the use of inheritable capabilities in your container configurations.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
