CVE-2022-24769: Inheritable Linux Process Capabilities in Moby (Docker Engine)
Summary
CVE-2022-24769: Moby (Docker Engine) started with non-empty inheritable Linux process capabilities in github.com/docker/docker. Affects github.com/docker/docker versions < 20.10.14+incompatible. Fixed in 20.10.14+incompatible. How to fix ↓
Also tracked for
- github.com/moby/moby · Go
- containerd · Debian:11
The same CVE-2022-24769 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moby (Docker Engine) is an open-source containerization platform that allows developers to automate the deployment, scaling, and management of applications using containers. It provides an environment for running applications in isolated containers, ensuring consistency and portability across different systems. The package 'github.com/docker/docker' is a Go implementation of the Docker Engine, while 'github.com/moby/moby' is the official repository for the Moby project, which includes the Docker Engine codebase. These packages are widely used in the containerization ecosystem.
Vulnerability Detail
The vulnerability (CVE-2022-24769) arises from Moby (Docker Engine) being started with non-empty inheritable Linux process capabilities. This can lead to potential security risks as the inheritable capabilities are passed on to child processes, potentially granting them elevated privileges. Attackers could exploit this vulnerability to gain unauthorized access, escalate privileges, or execute malicious code within containers. The vulnerability affects versions 0 to 20.10.2+incompatible of the 'github.com/docker/docker' and 'github.com/moby/moby' packages.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.10.14+incompatible
This is the first release that contains the fix.
go get github.com/docker/docker@v20.10.14+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general security practice, it is recommended to follow the principle of least privilege when running containers. This involves minimizing the capabilities granted to containers and ensuring that they only have access to the necessary resources and privileges required for their intended functionality.
Conclusion
The vulnerability (CVE-2022-24769) in Moby (Docker Engine) arises from starting with non-empty inheritable Linux process capabilities. It is crucial to update to version 20.10.14+incompatible or later of the 'github.com/docker/docker' and 'github.com/moby/moby' packages to mitigate the security risk. Following the principle of least privilege when running containers is also recommended to enhance overall container security.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Moby (Docker Engine) is an open-source containerization platform that automates the deployment, scaling, and management of applications using containers. It provides a consistent and portable environment for running applications in isolated containers.
The vulnerability allows Moby (Docker Engine) to start with non-empty inheritable Linux process capabilities, which can lead to potential security risks. Attackers could exploit this vulnerability to gain unauthorized access, escalate privileges, or execute malicious code within containers.
Versions 0 to 20.10.2+incompatible of the 'github.com/docker/docker' and 'github.com/moby/moby' packages are affected by this vulnerability.
To fix this vulnerability, update to version 20.10.14+incompatible or later of the 'github.com/docker/docker' and 'github.com/moby/moby' packages. Rebuild your applications after updating the dependencies.
While there is no specific workaround mentioned for this vulnerability, it is recommended to follow the principle of least privilege when running containers. Minimize the capabilities granted to containers and ensure they only have access to necessary resources and privileges.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
