Stay Secure with the Latest Linux Advisories

security advisorycritical issueMageia 8

Mageia 8 MGASA-2022-0192 Critical: Opencontainers-Runc Exec Process Bug

A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set . MGASA-2022-0192 - Updated opencontainers-runc packages fix security vulnerability Publication date: 21 May 2022 URL: https://advisories.mageia.org/MGASA-2022-0192.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-29162 A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. (CVE-2022-29162) References: - https://bugs.mageia.org/show_bug.cgi?id=30421 - https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 - https://www.openwall.com/lists/oss-security/2022/05/12/1 - https://www.cve.org/CVERecord?id=CVE-2022-29162 SRPMS: - 8/core/opencontainers-runc-1.1.2-2.mga8 . The latest release of Opencontainers-runc tackles a severe flaw that poses risks of privilege escalation. Ensure you upgrade your systems without delay.. Mageia 8, opencontainers-runc, critical security update. . Severity: Critical. LinuxSecurity.com Team

May 21, 2022 •Critical Mageia