A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.

...

SUSE-SU-2022:4113-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040022 fixes several issues. The following security issues were fixed: - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUTVSCREENINFO bnc1201635. - CVE-2022-1882: Fixed a use-after-free flaw in freepipeinfo that could allow a local user to cra...

SUSE-SU-2022:4112-1 Security update for the Linux Kernel (Live Patch 27 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024115 fixes several issues. The following security issues were fixed: - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUTVSCREENINFO bnc1201635. - CVE-2022-2588: Fixed use-after-free in clsroute bsc1202096. - CVE-2022-42703: Fixed...

runc: incorrect handling of inheritable capabilities

A flaw was found in runc, where runc exec --cap executed processes with non-empty inheritable Linux process capabilities. This issue creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve2...

kernel: exec: Force single empty string when argv is empty

In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting1 Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve2 be the name of a program, thus prohibiting a scenario...

runc: incorrect handling of inheritable capabilities

A flaw was found in runc, where runc exec --cap executed processes with non-empty inheritable Linux process capabilities. This issue creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve2...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ALSA-2022:7318 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: posix cpu timer use-after-free may lead to local privilege escalation CVE-2022-2585 Unprivileged users may use PTRACESEIZE to set PTRACEOSUSPENDSECCOMP option CVE-2022-30594 For more details abou...

CRI-O 安全漏洞

CRI-O is a lightweight container runtime environment for the Kubernetes system. CRI-O suffers from a security vulnerability that stems from the fact that it allows an attacker with programmatic access to inheritable file features to elevate those features to the allowed set when running execve2...

runc: incorrect handling of inheritable capabilities

A flaw was found in runc, where runc exec --cap executed processes with non-empty inheritable Linux process capabilities. This issue creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve2...

GSD-2022-1004738 powerpc: Enable execve syscall exit tracepoint

powerpc: Enable execve syscall exit tracepoint This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.202 by commit...

GSD-2022-1004621 powerpc: Enable execve syscall exit tracepoint

powerpc: Enable execve syscall exit tracepoint This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.127 by commit...

GSD-2022-1004454 powerpc: Enable execve syscall exit tracepoint

powerpc: Enable execve syscall exit tracepoint This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.51 by commit...

PT-2022-33194

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.321 Description The issue is related to the powerpc architecture in the Linux Kernel, specifically concerning the execve syscall exit tracepoint. The actual impact and potential for attack have not been prov...

PT-2022-32511

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.8 Description The issue is related to the powerpc architecture in the Linux Kernel, specifically concerning the execve syscall exit tracepoint. The actual impact and potential for attack have not been prove...

PT-2022-33148

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.286 Description The issue is related to the powerpc architecture in the Linux Kernel, specifically concerning the execve syscall exit tracepoint. The actual impact and potential for attack have not been...

PT-2022-32883

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.127 Description The issue is related to the powerpc architecture in the Linux Kernel, specifically concerning the execve syscall exit tracepoint. The actual impact and potential for attack have not been...

PT-2022-33000

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.202 Description The issue is related to the powerpc architecture in the Linux Kernel, specifically concerning the execve syscall exit tracepoint. The actual impact and potential for attack have not been prov...

PT-2022-32716

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.51 Description The issue is related to the powerpc enable execve syscall exit tracepoint. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

PT-2022-33086

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.250 Description The issue is related to the powerpc architecture in the Linux Kernel, specifically concerning the execve syscall exit tracepoint. The actual impact and potential for attack have not been...