CVE catalog

CVE-2022-24769

containerd: CVE-2022-24769

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1fixed
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1fixed
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3fixed
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2fixed
Ubuntucontainerdpro0.2.1-0ubuntu4~16.04vulnerable
Ubuntucontainerdpro0.2.3-0ubuntu1~16.04vulnerable
Ubuntucontainerdpro0.2.5-0ubuntu1~16.04.1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.3vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm7vulnerable
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.1vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.2vulnerable
Ubuntucontainerd18.041.5.9-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.9-0ubuntu1~18.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.5vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.6fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1fixed
Opensuserunctumbleweed1.1.2-1.1fixed
Opensusedockertumbleweed20.10.14_ce-1.1fixed
Opensusecontainerdtumbleweed1.5.11-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid1.6.2~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourceforky1.6.2~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourcetrixie1.6.2~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourcebookworm1.6.2~ds1-1not yet assignedNot reportedNot reported
Ubuntucontainerddeb18.041.5.9-0ubuntu1~18.04.2Not reportedUBUNTU-CVE-2022-24769Not reported
Ubuntucontainerddeb20.041.5.9-0ubuntu1~20.04.6Not reportedUBUNTU-CVE-2022-24769Not reported
Ubuntucontainerddeb22.041.5.9-0ubuntu3.1Not reportedUBUNTU-CVE-2022-24769Not reported
Opensuseruncrpmtumbleweed1.1.2-1.1Not reportedOPENSUSE-SU-2024:12074-1Not reported
Opensusedockerrpmtumbleweed20.10.14_ce-1.1Not reportedOPENSUSE-SU-2024:12002-1Not reported
Opensusecontainerdrpmtumbleweed1.5.11-1.1Not reportedOPENSUSE-SU-2024:12001-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [containerd]Unknown
    Details (4)

    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

  • [golang-github-containerd-containerd-dev]Unknown

    Source package: [containerd]

    Details (4)

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.2~ds1-1

      dsa · containerd · debian · bookworm

[openSUSE Tumbleweed]

  • [containerd]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.5.11-1.1

      dsa · containerd · opensuse · tumbleweed

  • [containerd-ctr]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.5.11-1.1

      Version impact unknown

      dsa · containerd · opensuse · tumbleweed

  • [containerd-devel]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.5.11-1.1

      Version impact unknown

      dsa · containerd · opensuse · tumbleweed

  • [docker]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · x86_64 · tumbleweed

      Fixed · Fixed: 20.10.14_ce-1.1

      dsa · docker · opensuse · tumbleweed

  • [docker-bash-completion]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.14_ce-1.1

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • [docker-buildx]Unknown

    Source package: [docker]

    Details (1)

    • 0.33.0-40.3 · x86_64 · tumbleweed

      Unknown · Fixed: 20.10.14_ce-1.1

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • [docker-fish-completion]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.14_ce-1.1

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • [docker-rootless-extras]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.14_ce-1.1

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • [docker-zsh-completion]Unknown

    Source package: [docker]

    Details (1)

    • 29.4.0_ce-40.3 · noarch · tumbleweed

      Unknown · Fixed: 20.10.14_ce-1.1

      Version impact unknown

      dsa · docker · opensuse · tumbleweed

  • [runc]Unknown

    Source package: [runc]

    Details (1)

    • 1.4.3-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 1.1.2-1.1

      dsa · runc · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]