{"id":"CVE-2022-24769","title":"moby: Default inheritable capabilities for linux container should be empty (CVE-2022-24769)","summary":"A flaw was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate t…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-276","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["migration_toolkit_for_virtualization","advanced_cluster_security 3","enterprise_linux 7","openshift_container_platform 4","openshift_container_platform_assisted_installer 1","openshift_virtualization 2","openshift_virtualization 4","quay 3","openshift_container_platform 4.10","openshift_container_platform 4.6","openshift_container_platform 4.7","openshift_container_platform 4.8","openshift_container_platform 4.9"],"patched":["openshift_container_platform 4.10","openshift_container_platform 4.6","openshift_container_platform 4.7","openshift_container_platform 4.8","openshift_container_platform 4.9"],"published":"2022-03-23","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:19:20+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24769.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24769.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-24769"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066837"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24769"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24769"},{"url":"https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq"},{"url":"https://access.redhat.com/errata/RHSA-2022:1357"},{"url":"https://access.redhat.com/errata/RHSA-2022:2265"},{"url":"https://access.redhat.com/errata/RHSA-2022:1622"},{"url":"https://access.redhat.com/errata/RHSA-2022:1699"},{"url":"https://access.redhat.com/errata/RHSA-2022:1370"},{"url":"https://access.redhat.com/errata/RHSA-2022:1363"},{"url":"https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f"},{"url":"https://github.com/moby/moby/commit/7f375bcff41ce672cd61e9a31f3eeb2966e3dbe1"},{"url":"https://www.debian.org/security/2022/dsa-5162"},{"url":"https://security.gentoo.org/glsa/202401-31"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC"},{"url":"https://github.com/moby/moby/releases/tag/v20.10.14"},{"url":"https://github.com/moby/moby"},{"url":"http://www.openwall.com/lists/oss-security/2022/05/12/1"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00492,"epssPercentile":0.42043,"aliases":["GHSA-2mm7-x5h6-5pvq","GO-2022-0390"],"ecosystem":"go","scores":{"vendor":4.8,"osv":5.9},"ingestedAt":"2026-09-12T03:13:01.745Z","slug":"CVE-2022-24769","body":"## Overview\n\nA flaw was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. Containers using Linux users and groups to perform privilege separation inside the container are most directly impacted.\n\n## Vendor advisories\n\n- **RHSA-2022:1357** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2022-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2022:1357)\n- **RHSA-2022:2265** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.6 · released 2022-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2022:2265)\n- **RHSA-2022:1622** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.6 · released 2022-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2022:1622)\n- **RHSA-2022:1699** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.7 · released 2022-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2022:1699)\n- **RHSA-2022:1370** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.8 · released 2022-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2022:1370)\n- **RHSA-2022:1363** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.9 · released 2022-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2022:1363)\n- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Virtualization, Red Hat Advanced Cluster Security 3, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform Assisted Installer 1, Red Hat OpenShift Virtualization 2, … · no fix planned: Migration Toolkit for Virtualization, Red Hat Advanced Cluster Security 3, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24769.json)\n\n**moby: Default inheritable capabilities for linux container should be empty** — rated Moderate by Red Hat. Released 2022-03-23, updated 2026-10-16.\n\nAffected:\n\n- Migration Toolkit for Virtualization\n- Red Hat Advanced Cluster Security 3\n- Red Hat Enterprise Linux 7\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Container Platform Assisted Installer 1\n- Red Hat OpenShift Virtualization 2\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n\nFixed:\n\n- Red Hat OpenShift Container Platform 4.10\n- Red Hat OpenShift Container Platform 4.6\n- Red Hat OpenShift Container Platform 4.7\n- Red Hat OpenShift Container Platform 4.8\n- Red Hat OpenShift Container Platform 4.9\n\nNo fix planned:\n\n- Migration Toolkit for Virtualization\n- Red Hat Advanced Cluster Security 3\n- Red Hat Enterprise Linux 7\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Container Platform Assisted Installer 1\n- Red Hat OpenShift Virtualization 2\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 4.10\n- Red Hat OpenShift Container Platform 4.6\n- Red Hat OpenShift Container Platform 4.7\n- Red Hat OpenShift Container Platform 4.8\n- Red Hat OpenShift Container Platform 4.9\n\n## Remediation\n\nFor OpenShift Container Platform 4.10 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2022:1357\n\"For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html\" https://access.redhat.com/errata/RHSA-2022:2265\nFor OpenShift Container Platform 4.6 see the following documentation, which\nwill be updated shortly for this release, for important instructions on how\nto upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2022:1622\n\nWorkarounds / mitigations:\n\n- The entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.\n\n## Package advisory (CVE-2022-24769)\n\nAffected packages:\n\n- `github.com/moby/moby < 20.10.14`\n- `github.com/docker/docker < 20.10.14`\n\nPatched in:\n\n- `github.com/moby/moby 20.10.14`\n- `github.com/docker/docker 20.10.14`\n\nSource: https://osv.dev/vulnerability/GHSA-2mm7-x5h6-5pvq","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223812,"id":"CVE-2022-24769","ts":1792238441964,"field":"cvss","old":"5.9","new":"4.8"}]}