Skip to content
Fencer Vulns
medium 5.3

CVE-2022-36109 json

Moby vulnerability relating to supplementary group permissions

published 2022-09-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-6933 , GHSA-rc4r-wh2q-q6c4 , GO-2022-0985

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.

Patch / fix

  • go github.com/docker/docker 20.10.18, 20.10.18+incompatible
  • mobyproject moby 20.10.18
  • docker.io Debian 14, Debian 13, Debian 12 20.10.19+dfsg1-1

debian advisories DEBIAN-CVE-2022-36109

  • docker.io Ubuntu 18.04 LTS 20.10.21-0ubuntu1~18.04.2
  • docker.io Ubuntu 20.04 LTS 20.10.21-0ubuntu1~20.04.1
  • docker.io Ubuntu 22.04 LTS 20.10.21-0ubuntu1~22.04.2

ubuntu advisories UBUNTU-CVE-2022-36109

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker SLE Module for Containers 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +16 more 20.10.23_ce-150000.175.1
  • docker SLE Module for Containers 12 20.10.23_ce-98.89.1
  • docker-stable SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 24.0.9_ce-1.20.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2023:0795-2SUSE-SU-2023:1625-1SUSE-SU-2023:0795-1

  • docker-stable openSUSE Tumbleweed 24.0.9_ce-15.1
  • docker openSUSE Tumbleweed 20.10.23_ce-2.1

opensuse advisories openSUSE-SU-2025:15589-1openSUSE-SU-2024:12790-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 20.10.18-r0

alpine advisories ALPINE-CVE-2022-36109

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-36109 updated cvss 6.3

moby: supplementary groups mishandling

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9
    affected: no fix available
  • Red Hat OpenShift Developer Tools and Services jenkins-operator-container, jenkins-operator-bundle-container Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-scanner-slim-rhel8 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-ptp-operator, assisted-installer-container, openshift4/ptp-must-gather-rhel8, openshift4/ovirt-csi-driver-rhel8, assisted-installer-agent-container, +14 more
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8, rhai-tech-preview/assisted-installer-reporter-rhel8
    affected: no fix available
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/vm-import-virtv2v-rhel8, container-native-virtualization/vm-import-operator-rhel8, container-native-virtualization/vm-import-controller-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/proxyv2-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/agent-service-rhel8, rhacm2/assisted-installer-rhel8, rhacm2/assisted-installer-agent-rhel8, rhacm2/assisted-installer-reporter-rhel8, rhacm2/managedcluster-import-controller-rhel8, rhacm2/multicluster-operators-subscription-rhel8, +1 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-scanner-db-rhel8, advanced-cluster-security/rhacs-scanner-db-slim-rhel8 Red Hat OpenShift Container Platform 4 openshift4/ose-local-storage-diskmaker, openshift4/ose-local-storage-rhel9-operator, openshift4/ose-local-storage-mustgather-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/docker/docker
<20.10.18
<20.10.18+incompatible
20.10.18
20.10.18+incompatible

Affected products

  • moby moby

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.