Описание
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most dire...
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 1.5.9-0ubuntu1~18.04.2 |
| devel | not-affected | 1.6.4-0ubuntu1 |
| esm-apps-legacy/xenial | needed | |
| esm-apps/bionic | released | 1.5.9-0ubuntu1~18.04.2 |
| esm-apps/noble | not-affected | 1.6.4-0ubuntu1 |
| esm-apps/resolute | not-affected | 1.6.4-0ubuntu1 |
| esm-apps/xenial | ignored | end of ESM support, was needed |
| esm-infra/focal | released | 1.5.9-0ubuntu1~20.04.6 |
| focal | released | 1.5.9-0ubuntu1~20.04.6 |
| impish | ignored | end of life |
Показывать по
Ссылки на источники
EPSS
4.6 Medium
CVSS2
5.9 Medium
CVSS3
Связанные уязвимости
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most dire...
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directl
Moby is an open-source project created by Docker to enable and acceler ...
Moby (Docker Engine) started with non-empty inheritable Linux process capabilities
EPSS
4.6 Medium
CVSS2
5.9 Medium
CVSS3