Skip to content
Fencer Vulns
medium 5.9

CVE-2022-29162 json

Incorrect Default Permissions in runc

published 2022-05-17 4 y ago modified 2026-09-10 1 mo ago also GHSA-f3fp-gc8g-vw66 , GO-2022-0452 , EUVD-2022-3675

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

Patch / fix

  • go github.com/opencontainers/runc 1.1.2
  • linuxfoundation runc 1.1.2
  • runc Debian 14, Debian 13, Debian 12 1.1.3+ds1-1

debian advisories DEBIAN-CVE-2022-29162

  • runc Ubuntu Pro 16.04 LTS 1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4

ubuntu advisories UBUNTU-CVE-2022-29162

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • crit RHEL 8 3.15-3.module+el8.7.0+16772+33343656
  • criu RHEL 8 3.15-3.module+el8.7.0+16772+33343656
  • crun RHEL 8 1.5-1.module+el8.7.0+16772+33343656
  • runc RHEL 8 1:1.1.4-1.module+el8.7.0+16772+33343656
  • udica RHEL 8 0.2.6-3.module+el8.7.0+16772+33343656
  • conmon RHEL 8 3:2.1.4-1.module+el8.7.0+16772+33343656
  • podman RHEL 8 3:4.2.0-1.module+el8.7.0+16772+33343656
  • skopeo RHEL 8 2:1.9.2-1.module+el8.7.0+16772+33343656

red hat advisories RHSA-2022:7457RHSA-2022:7469RHSA-2022:5068RHSA-2022:8090

  • kubevirt SLE Module for Containers 15 SP4, openSUSE Leap 15.4 0.54.0-150400.3.3.2
  • kubevirt SLE Module for Containers 15 SP3, openSUSE Leap 15.3 0.49.0-150300.8.13.1
  • runc SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +23 more 1.1.3-150000.30.1
  • docker SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +22 more 20.10.17_ce-150000.166.1
  • containerd SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +23 more 1.6.6-150000.73.2
  • docker-kubic openSUSE Leap 15.4, openSUSE Leap 15.3 20.10.17_ce-150000.166.1
  • containerd SLE Module for Containers 12 1.6.6-16.62.1
  • runc SLE Module for Containers 12 1.1.3-16.21.1

suse advisories SUSE-SU-2022:3333-1SUSE-SU-2022:3321-1SUSE-SU-2022:2341-1SUSE-SU-2022:2165-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1
  • runc openSUSE Tumbleweed 1.1.2-1.1

opensuse advisories openSUSE-SU-2025:15424-1openSUSE-SU-2024:12074-1

  • runc AlmaLinux 9 4:1.1.4-1.el9
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.5-1.module_el8.7.0+3344+5bcd850f
  • runc AlmaLinux 8 1:1.1.4-1.module_el8.7.0+3344+484dae7b
  • udica AlmaLinux 8 0.2.6-3.module_el8.6.0+2886+d33c3efb

almalinux advisories ALSA-2022:8090ALSA-2022:7469

  • runc Rocky Linux 9 4:1.1.4-1.el9_1
  • criu Rocky Linux 8 3.15-3.module+el8.7.0+1077+0e4f03d4
  • criu Rocky Linux 8 3.15-3.module+el8.5.0+710+4c471e88
  • criu Rocky Linux 8 3.15-3.module+el8.6.0+1054+50b00ff4
  • crun Rocky Linux 8 1.5-1.module+el8.7.0+1077+0e4f03d4
  • crun Rocky Linux 8 1.5-1.module+el8.6.0+1054+50b00ff4
  • runc Rocky Linux 8 1:1.1.4-1.module+el8.7.0+1077+0e4f03d4
  • udica Rocky Linux 8 0.2.6-3.module+el8.7.0+1077+0e4f03d4

rocky linux advisories RLSA-2022:8090RLSA-2022:7469RLSA-2022:7457

  • runc Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 1.1.2-r0

alpine advisories ALPINE-CVE-2022-29162

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-runc CBL-Mariner 2.0 1.1.2-2

azure linux advisories AZL-9817

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-29162 updated cvss 5.6

runc: incorrect handling of inheritable capabilities

  • Red Hat Enterprise Linux 7 runc
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 runc
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 3.11 runc
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) crun 1.5-1.module+el8.7.0+16520+2db5507d, crun 1.5-1.module+el8.7.0+16772+33343656, crit 3.15-3.module+el8.7.0+16520+2db5507d, crit 3.15-3.module+el8.7.0+16772+33343656, criu 3.15-3.module+el8.7.0+16520+2db5507d, criu 3.15-3.module+el8.7.0+16772+33343656, +60 more
    fixed: vendor fix RHSA-2022:7469
  • Red Hat Enterprise Linux AppStream (v. 9) runc 1.1.4-1.el9
    fixed: vendor fix RHSA-2022:8090
  • Red Hat OpenShift Container Platform 4.11 runc 1.1.2-1.rhaos4.11.el8
    fixed: vendor fix RHSA-2022:5068
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 pysnmp 4.4.8-3.el8, pyparsing 2.3.1-2.el8, libsodium 1.0.16-5.el8, python-pbr 5.5.1-2.el8, python-yappi 1.0-3.el8, python-amqp 2.5.2-8.el8, +273 more Red Hat OpenShift Container Platform 4.11 buildah 1.23.4-2.el8, haproxy 2.2.24-1.el8, haproxy22 2.2.24-1.el8, cri-tools 1.24.2-4.1.el8, crit 3.15-4.rhaos4.11.el8, criu 3.15-4.rhaos4.11.el8, +60 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 5.9

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/opencontainers/runc
<1.1.2
1.1.2

Affected products

  • opencontainers runc

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.