USN-5427-1: Apport vulnerabilities

Muqing Liu and neoni discovered that Apport incorrectly handled detecting if an executable was replaced after a crash. A local attacker could possibly use this issue to execute arbitrary code as the root user. CVE-2021-3899 Gerrit Venema discovered that Apport incorrectly handled connections to...

CVE-2022-29162

CVE-2022-29162 affects runc prior to version 1.1.2, where runc exec --cap could create processes with inheritable Linux capabilities, enabling elevation of capabilities to the permitted set during execve. The issue does not affect the container sandbox since the inheritable set is bounded by the ...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:1762)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1762 advisory. psgo: Privilege escalation in 'podman top' CVE-2022-1227 prometheus/clientgolang: Denial of service using InstrumentHandlerCounter CVE-2022-21698 podman:...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.513.2.el7 - Revert 'rds/ib: recover rds connection from stuck tx path' Nagappan Ramasamy Palaniappan Orabug: 34124234 4.14.35-2047.513.1.el7 - mm/page-writeback: Fix performance when BDI's share of ratio is 0. Chi Wu Orabug: 34050050 - esp: Fix possible buffer overflow in ESP...

CVE-2022-0071

CVE-2022-0071 documents confirm an incomplete fix for CVE-2021-3101 in Hotdog prior to v1.0.2. The vulnerability arises because Hotdog did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. As a result, a container could exhaust host resources, modif...

CVE-2021-3101

CVE-2021-3101 concerns Hotdog (a Bottlerocket OCI hook) before v1.0.1. It did not mimic the capabilities/SELinux label of the target JVM process, enabling a container to gain full privileges on the host and bypass container restrictions. Affected component: Hotdog (prior to 1.0.1); exploitation c...

Hotdog 安全漏洞

Hotdog is a set of OCI hooks for injecting Log4j Hot Patch into containers. A resource management error vulnerability exists in Hotdog versions prior to v1.0.2, which arises from an application that does not effectively perform resource limiting, device limiting, or syscall filters on the target...

CVE-2022-27652

CVE-2022-27652 relates to a security regression in cri-o/OpenShift container components where containers could be started with inheritable capabilities improperly. The Red Hat advisories note that the issue involves adding the fix for CVE-2022-27652 to certain OpenShift releases, and that older O...

cri-o 安全漏洞

cri-o is a lightweight container runtime environment for the Kubernetes system. A security vulnerability exists in cri-o that stems from software that incorrectly starts containers using non-empty default permissions. An attacker accessing a program with inheritable file functionality exploits th...

Improper access control

A vulnerability in the Common Execution Environment CEE ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure SMI software could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to insufficient access control in...

AZL-9320 CVE-2022-27649 affecting package podman for versions less than 4.1.1-1

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to...

UBUNTU-CVE-2022-27649

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to...

CVE-2022-27650

CVE-2022-27650 describes a flaw where crun (and related components used by container runtimes like Moby/Docker Engine) can cause containers to start with non-empty default inheritable capabilities. The issue enables an attacker who has access to programs with inheritable file capabilities to elev...

CVE-2022-27651

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby Docker Engine where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with...

CVE-2022-27652

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby Docker Engine where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs...

CVE-2022-24769

A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve2 runs...

Moby 权限许可和访问控制问题漏洞

Moby is an open source project designed to drive containerization of software and help the ecosystem mainstream container technology. A privilege licensing and access control issue vulnerability exists in versions prior to Moby 20.10.14 that stems from a container incorrectly starting with a...

cri-o: pod with access to 'hostIPC' and 'hostNetwork' kernel namespace allows sysctl from the list of safe sysctls to be applied to the host

An incorrect sysctls validation vulnerability was found in CRI-O. The sysctls from the list of "safe" sysctls specified for the cluster 0 will be applied to the host if an attacker can create a pod with a hostIPC and hostNetwork kernel namespace...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.304.4.4 - arm64: Use the clearbhb instruction in mitigations James Morse Orabug: 33921646 - arm64: add IDAA64ISAR2EL1 sys register Joey Gouly Orabug: 33921646 - KVM: arm64: Allow SMCCCARCHWORKAROUND3 to be discovered and migrated James Morse Orabug: 33921646 - arm64: Mitigate spectre...

CVE-2021-3602

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...