CVE catalog

CVE-2022-27650

crun: CVE-2022-27650

[CVE catalog]

Severity
Medium · CVSS 5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.24% · Oct 25, 2026

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancrunsid1.28-1fixed
Debiancrunforky1.28-1fixed
Debiancruntrixie1.21-1fixed
Debiancrunbookworm1.8.1-1+deb12u1fixed
Opensusecruntumbleweed1.4.4-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancrunsourcesid1.5+dfsg-1not yet assignedNot reported[1009881]
Debiancrunsourceforky1.5+dfsg-1not yet assignedNot reported[1009881]
Debiancrunsourcetrixie1.5+dfsg-1not yet assignedNot reported[1009881]
Debiancrunsourcebookworm1.5+dfsg-1not yet assignedNot reported[1009881]
Opensusecrunrpmtumbleweed1.4.4-1.1Not reportedOPENSUSE-SU-2024:11989-1Not reported

[Debian bug #1009881]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [crun-krun]Unknown

    Source package: [crun]

    Details (1)

    • 1.28-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.4-1.1

      Version impact unknown

      dsa · crun · opensuse · tumbleweed

  • [crun]Fixed

    Source package: [crun]

    Details (1)

    • 1.28-2.2 · x86_64 · tumbleweed

      Fixed · Fixed: 1.4.4-1.1

      dsa · crun · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [crun]Fixed
    Details (2)

    • 1.8.1-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.5+dfsg-1

      dsa · crun · debian · bookworm

    • 1.8.1-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.5+dfsg-1

      dsa · crun · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]