CVE catalog

CVE-2022-29162

runc: CVE-2022-29162

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruncsid1.3.6+ds1-1fixed
Debianruncforky1.3.6+ds1-1fixed
Debianrunctrixie1.1.15+ds1-2fixed
Debianruncbookworm1.1.5+ds1-1+deb12u1fixed
Debianruncbookworm-security1.1.5+ds1-1+deb12u1fixed
Susecontainerdlinux enterprise module for containers 15 sp31.6.6-150000.73.2fixed
Susedockerlinux enterprise module for containers 15 sp320.10.17_ce-150000.166.1fixed
Suserunclinux enterprise module for containers 15 sp31.1.3-150000.30.1fixed
Susecontainerdlinux enterprise module for containers 15 sp41.6.6-150000.73.2fixed
Susedockerlinux enterprise module for containers 15 sp420.10.17_ce-150000.166.1fixed
Suserunclinux enterprise module for containers 15 sp41.1.3-150000.30.1fixed
Susecontainerdlinux enterprise module for package hub 15 sp31.6.6-150000.73.2fixed
Susecontainerdlinux enterprise high performance computing 15-espos1.6.6-150000.73.2fixed
Susedockerlinux enterprise high performance computing 15-espos20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise high performance computing 15-espos1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise high performance computing 15-ltss1.6.6-150000.73.2fixed
Susedockerlinux enterprise high performance computing 15-ltss20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise high performance computing 15-ltss1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp1-espos1.6.6-150000.73.2fixed
Susedockerlinux enterprise high performance computing 15 sp1-espos20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise high performance computing 15 sp1-espos1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp1-ltss1.6.6-150000.73.2fixed
Susedockerlinux enterprise high performance computing 15 sp1-ltss20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise high performance computing 15 sp1-ltss1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp2-espos1.6.6-150000.73.2fixed
Susedockerlinux enterprise high performance computing 15 sp2-espos20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise high performance computing 15 sp2-espos1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp2-ltss1.6.6-150000.73.2fixed
Susedockerlinux enterprise high performance computing 15 sp2-ltss20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise high performance computing 15 sp2-ltss1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server 15-ltss1.6.6-150000.73.2fixed
Susedockerlinux enterprise server 15-ltss20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server 15-ltss1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server 15 sp1-bcl1.6.6-150000.73.2fixed
Susedockerlinux enterprise server 15 sp1-bcl20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server 15 sp1-bcl1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server 15 sp1-ltss1.6.6-150000.73.2fixed
Susedockerlinux enterprise server 15 sp1-ltss20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server 15 sp1-ltss1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server 15 sp2-bcl1.6.6-150000.73.2fixed
Susedockerlinux enterprise server 15 sp2-bcl20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server 15 sp2-bcl1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server 15 sp2-ltss1.6.6-150000.73.2fixed
Susedockerlinux enterprise server 15 sp2-ltss20.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server 15 sp2-ltss1.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server for sap applications 151.6.6-150000.73.2fixed
Susedockerlinux enterprise server for sap applications 1520.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server for sap applications 151.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server for sap applications 15 sp11.6.6-150000.73.2fixed
Susedockerlinux enterprise server for sap applications 15 sp120.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server for sap applications 15 sp11.1.3-150000.30.1fixed
Susecontainerdlinux enterprise server for sap applications 15 sp21.6.6-150000.73.2fixed
Susedockerlinux enterprise server for sap applications 15 sp220.10.17_ce-150000.166.1fixed
Suserunclinux enterprise server for sap applications 15 sp21.1.3-150000.30.1fixed
Susecontainerdmanager proxy 4.11.6.6-150000.73.2fixed
Susedockermanager proxy 4.120.10.17_ce-150000.166.1fixed
Suseruncmanager proxy 4.11.1.3-150000.30.1fixed
Susecontainerdmanager retail branch server 4.11.6.6-150000.73.2fixed
Susedockermanager retail branch server 4.120.10.17_ce-150000.166.1fixed
Suseruncmanager retail branch server 4.11.1.3-150000.30.1fixed
Susecontainerdmanager server 4.11.6.6-150000.73.2fixed
Susedockermanager server 4.120.10.17_ce-150000.166.1fixed
Suseruncmanager server 4.11.1.3-150000.30.1fixed
Susecontainerdlinux enterprise micro 5.11.6.6-150000.73.2fixed
Susedockerlinux enterprise micro 5.120.10.17_ce-150000.166.1fixed
Suserunclinux enterprise micro 5.11.1.3-150000.30.1fixed
Susecontainerdlinux enterprise micro 5.21.6.6-150000.73.2fixed
Susedockerlinux enterprise micro 5.220.10.17_ce-150000.166.1fixed
Suserunclinux enterprise micro 5.21.1.3-150000.30.1fixed
Susecontainerdenterprise storage 61.6.6-150000.73.2fixed
Susedockerenterprise storage 620.10.17_ce-150000.166.1fixed
Suseruncenterprise storage 61.1.3-150000.30.1fixed
Susecontainerdenterprise storage 71.6.6-150000.73.2fixed
Susedockerenterprise storage 720.10.17_ce-150000.166.1fixed
Suseruncenterprise storage 71.1.3-150000.30.1fixed
Suseruncenterprise storage 7.11.1.3-150000.30.1fixed
Opensusecontainerdleap 15.31.6.6-150000.73.2fixed
Opensusedockerleap 15.320.10.17_ce-150000.166.1fixed
Opensusedocker-kubicleap 15.320.10.17_ce-150000.166.1fixed
Opensuseruncleap 15.31.1.3-150000.30.1fixed
Opensusecontainerdleap 15.41.6.6-150000.73.2fixed
Opensusedockerleap 15.420.10.17_ce-150000.166.1fixed
Opensusedocker-kubicleap 15.420.10.17_ce-150000.166.1fixed
Opensuseruncleap 15.41.1.3-150000.30.1fixed
Susecontainerdlinux enterprise module for containers 121.6.6-16.62.1fixed
Susedockerlinux enterprise module for containers 1220.10.17_ce-98.83.1fixed
Suserunclinux enterprise module for containers 121.1.3-16.21.1fixed
Ubunturuncpro0.0.8+dfsg-2vulnerable
Ubunturuncpro0.1.1-0ubuntu5~16.04vulnerable
Ubunturuncpro1.0.0~rc1-0ubuntu1~16.04vulnerable
Ubunturuncpro1.0.0~rc1-0ubuntu2~16.04.1vulnerable
Ubunturuncpro1.0.0~rc1-0ubuntu2~16.04.1.1vulnerable
Ubunturuncpro1.0.0~rc2-0ubuntu2~16.04.1vulnerable
Ubunturuncpro1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1vulnerable
Ubunturuncpro1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1vulnerable
Ubunturuncpro1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2vulnerable
Ubunturuncpro1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruncsourcesid1.1.3+ds1-1not yet assignedNot reportedNot reported
Debianruncsourceforky1.1.3+ds1-1not yet assignedNot reportedNot reported
Debianruncsourcetrixie1.1.3+ds1-1not yet assignedNot reportedNot reported
Debianruncsourcebookworm1.1.3+ds1-1not yet assignedNot reportedNot reported
Susecontainerdrpmlinux enterprise module for containers 15 sp31.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise module for containers 15 sp320.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise module for containers 15 sp31.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp41.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise module for containers 15 sp420.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise module for containers 15 sp41.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise module for package hub 15 sp31.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15-espos1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise high performance computing 15-espos20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise high performance computing 15-espos1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15-ltss1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise high performance computing 15-ltss20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise high performance computing 15-ltss1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp1-espos1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise high performance computing 15 sp1-espos20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise high performance computing 15 sp1-espos1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp1-ltss1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise high performance computing 15 sp1-ltss20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise high performance computing 15 sp1-ltss1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp2-espos1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise high performance computing 15 sp2-espos20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise high performance computing 15 sp2-espos1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp2-ltss1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise high performance computing 15 sp2-ltss20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise high performance computing 15 sp2-ltss1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server 15-ltss1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server 15-ltss20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server 15-ltss1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp1-bcl1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server 15 sp1-bcl20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server 15 sp1-bcl1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp1-ltss1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server 15 sp1-ltss20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server 15 sp1-ltss1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp2-bcl1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server 15 sp2-bcl20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server 15 sp2-bcl1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp2-ltss1.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server 15 sp2-ltss20.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server 15 sp2-ltss1.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 151.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server for sap applications 1520.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server for sap applications 151.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 15 sp11.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server for sap applications 15 sp120.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server for sap applications 15 sp11.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 15 sp21.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise server for sap applications 15 sp220.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise server for sap applications 15 sp21.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmmanager proxy 4.11.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmmanager proxy 4.120.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmmanager proxy 4.11.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmmanager retail branch server 4.11.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmmanager retail branch server 4.120.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmmanager retail branch server 4.11.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmmanager server 4.11.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmmanager server 4.120.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmmanager server 4.11.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise micro 5.11.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise micro 5.120.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise micro 5.11.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise micro 5.21.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmlinux enterprise micro 5.220.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmlinux enterprise micro 5.21.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmenterprise storage 61.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmenterprise storage 620.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmenterprise storage 61.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmenterprise storage 71.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Susedockerrpmenterprise storage 720.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmenterprise storage 71.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Suseruncrpmenterprise storage 7.11.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Opensusecontainerdrpmleap 15.31.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Opensusedockerrpmleap 15.320.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Opensusedocker-kubicrpmleap 15.320.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Opensuseruncrpmleap 15.31.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Opensusecontainerdrpmleap 15.41.6.6-150000.73.2Not reportedSUSE-SU-2022:2341-1Not reported
Opensusedockerrpmleap 15.420.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Opensusedocker-kubicrpmleap 15.420.10.17_ce-150000.166.1Not reportedSUSE-SU-2022:2341-1Not reported
Opensuseruncrpmleap 15.41.1.3-150000.30.1Not reportedSUSE-SU-2022:2341-1Not reported
Susecontainerdrpmlinux enterprise module for containers 121.6.6-16.62.1Not reportedSUSE-SU-2022:2165-1Not reported
Susedockerrpmlinux enterprise module for containers 1220.10.17_ce-98.83.1Not reportedSUSE-SU-2022:2165-1Not reported
Suseruncrpmlinux enterprise module for containers 121.1.3-16.21.1Not reportedSUSE-SU-2022:2165-1Not reported
Ubunturuncdebpro1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4Not reportedUBUNTU-CVE-2022-29162Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [runc]

    Details (4)
    • 1.1.5+ds1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

    • 1.1.5+ds1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

    • 1.1.5+ds1-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

    • 1.1.5+ds1-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

  • [runc]Unknown
    Details (4)
    • 1.1.5+ds1-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

    • 1.1.5+ds1-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

    • 1.1.5+ds1-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

    • 1.1.5+ds1-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.3+ds1-1

      dsa · runc · debian · bookworm

Observed:

References