Skip to content
Fencer Intel
medium 5.3

CVE-2022-27652 json

Incorrect Default Permissions in CRI-O

published 4y ago modified 4mo ago also GHSA-4hj2-r2pm-3hc6 , GO-2022-0426 , EUVD-2022-1621

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Patch / fix

  • go github.com/cri-o/cri-o 1.24.0
  • mobyproject moby 20.10.14
  • cri-o openshift 4.9 1.22.5-7.rhaos4.9.git3dbcd3c.el7
  • cri-o openshift 4.9 1.22.5-7.rhaos4.9.git3dbcd3c.el8
  • cri-o openshift 4.10 1.23.2-8.rhaos4.10.git8ad5d25.el8
  • jenkins-2-plugins openshift 4.10 4.10.1650890594-1.el8

red hat advisories RHBA-2022:5433RHSA-2022:1600

Is CVE-2022-27652 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-27652 updated cvss 4.8

cri-o: Default inheritable capabilities for linux container should be empty

  • Red Hat OpenShift Container Platform 3.11 cri-o
    affected: workaround, no fix planned “The entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.”
  • Red Hat OpenShift Container Platform 4.9 cri-o 1.22.5-7.rhaos4.9.git3dbcd3c.el7, cri-o 1.22.5-7.rhaos4.9.git3dbcd3c.el8
    fixed: vendor fix “The entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.” RHBA-2022:5433
  • Red Hat OpenShift Container Platform 4.10 cri-o 1.23.2-8.rhaos4.10.git8ad5d25.el8
    fixed: vendor fix “The entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.” RHSA-2022:1600
  • Red Hat OpenShift Container Platform 4.9 ironic-images 2021.2-20220627.2.el8, ironic-images-all 2021.2-20220627.2.el8, ironic-images-ipa-x86_64 2021.2-20220627.2.el8, ironic-images-ipa-ppc64le 2021.2-20220627.2.el8, python3-ironic-python-agent 8.1.1-0.20220623092113.0849a1b.el8, openstack-ironic-python-agent 8.1.1-0.20220623092113.0849a1b.el8, +4 more Red Hat OpenShift Container Platform 4.10 jq 1.6-2.el7, python-boto 2.34.0-5.el7, jenkins 2.319.3.1650888800-1.el8, jenkins-2-plugins 4.10.1650890594-1.el8, openshift 4.10.0-202204251639.p0.g70fb84c.assembly.stream.el7, openshift 4.10.0-202204251639.p0.g70fb84c.assembly.stream.el8, +2 more
    not affected: vulnerable code not present “The entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/cri-o/cri-o
<1.24.0
1.24.0

Affected products

  • n/a cri-o

Classification

Weakness
  • CWE-276 Incorrect Default Permissions
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.