CVE-2022-27651: Non-empty default inheritable capabilities for linux container in Buildah
Summary
CVE-2022-27651: Incorrect default permissions in github.com/containers/buildah. Affects github.com/containers/buildah versions < 1.25.0. Fixed in 1.25.0. How to fix ↓
Also tracked for
- golang-github-containers-buildah · Debian:11
The same CVE-2022-27651 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a tool that facilitates building OCI container images. It is written in Go and is part of the containers project. Buildah allows users to create and manage containers without requiring a full container runtime. It provides a command-line interface (CLI) and a Go library for interacting with containers. This vulnerability affects the Buildah package and specifically impacts the Linux container environment created by Buildah.
Vulnerability Detail
The vulnerability in Buildah involves the creation of containers with non-empty inheritable Linux process capabilities. This results in an atypical Linux environment where programs with inheritable file capabilities can elevate those capabilities to the permitted set during execve(2). While this bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than the container's bounding set, it still poses a security risk. An attacker with access to a container created by Buildah could potentially exploit this vulnerability to gain elevated privileges or perform unauthorized actions.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.0
This is the first release that contains the fix.
go get github.com/containers/buildah@v1.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the Buildah package to the latest version as soon as possible.
Conclusion
The vulnerability in Buildah that allows containers to be created with non-empty inheritable Linux process capabilities has been addressed in version 1.25.0. Users are advised to update their Buildah package to the latest version to mitigate the risk of unauthorized actions or privilege escalation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
Buildah is a tool for building OCI container images. It allows users to create and manage containers without requiring a full container runtime.
This vulnerability allows programs with inheritable file capabilities to elevate their capabilities in the Linux container environment created by Buildah. This could potentially lead to unauthorized actions or privilege escalation.
No, the container security sandbox is not affected by this vulnerability. The inheritable set never contains more capabilities than the container's bounding set.
To fix this vulnerability, update your Buildah package to version 1.25.0 or later.
There is no known workaround for this vulnerability. It is recommended to update the Buildah package to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
