UpHeron
All vulnerabilities

Servers and applications

CVE-2022-29162

Default inheritable capabilities for linux container should be empty

Severity
High 7.8
Published
11 May 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.1.2
Also known as
GHSA-f3fp-gc8g-vw66
Sources
NVD, Project advisories (GitHub)

Description

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during…

Affected software

SoftwareAffected versions
runcServers and applications · cpe:a:linuxfoundation:runc
  • Every version before 1.1.2
runcServers and applications · github:opencontainers/runc
  • Every version before 1.1.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-29162
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-29162
  • GitHub Advisory Database https://github.com/advisories/GHSA-f3fp-gc8g-vw66
  • github.com https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66