CVE-2022-27651: Non-empty default inheritable capabilities for linux container in Buildah
Summary
CVE-2022-27651: Non-empty default inheritable capabilities for linux container in Buildah. Affects github.com/containers/buildah versions < 1.25.0. Fixed in 1.25.0. How to fix ↓
Also tracked for
- golang-github-containers-buildah · Debian:11
The same CVE-2022-27651 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a Go-based command-line tool used for building and managing OCI (Open Container Initiative) containers. It provides a simple and secure way to create container images without requiring a full container runtime. Buildah is widely used in the Go ecosystem for containerization purposes.
Vulnerability Detail
A bug was discovered in Buildah that resulted in containers being created with non-empty inheritable Linux process capabilities. This meant that the containers had an atypical Linux environment, allowing programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2) system calls. However, it's important to note that this bug did not impact the container security sandbox, as the inheritable set never contained more capabilities than were included in the container's bounding set.
How To Fix
Latest published version: v1.43.5 as of 22 Oct 2026
go get github.com/containers/buildah@v1.43.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.25.0
This is the first release that contains the fix.
go get github.com/containers/buildah@v1.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version of Buildah is the recommended solution.
Conclusion
The vulnerability in Buildah, which allowed containers to be created with non-empty inheritable Linux process capabilities, has been addressed in version 1.25.0. It is crucial to update to this fixed version to ensure the correct empty inheritable capabilities are set for containers. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/buildah →
FAQ
Buildah is a command-line tool used for building and managing OCI containers. It provides a simple and secure way to create container images without requiring a full container runtime.
This vulnerability allows programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2) system calls. However, it does not affect the container security sandbox.
To fix this vulnerability, update the Buildah package to version 1.25.0 or later.
No specific workaround is mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database. Please refer to the provided source link for details.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/buildah.
