--- id: CVE-2022-24769 title: >- moby: Default inheritable capabilities for linux container should be empty (CVE-2022-24769) summary: >- A flaw was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate t… severity: medium cvss: 4.8 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N' cvssSource: vendor cwe: CWE-276 vendor: Red Hat product: Red Hat OpenShift Container Platform 4 affected: - migration_toolkit_for_virtualization - advanced_cluster_security 3 - enterprise_linux 7 - openshift_container_platform 4 - openshift_container_platform_assisted_installer 1 - openshift_virtualization 2 - openshift_virtualization 4 - quay 3 - openshift_container_platform 4.10 - openshift_container_platform 4.6 - openshift_container_platform 4.7 - openshift_container_platform 4.8 - openshift_container_platform 4.9 patched: - openshift_container_platform 4.10 - openshift_container_platform 4.6 - openshift_container_platform 4.7 - openshift_container_platform 4.8 - openshift_container_platform 4.9 published: '2022-03-23' updated: '2026-10-16' sourceUpdated: '2026-10-16T17:19:20+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24769.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24769.json - url: 'https://access.redhat.com/security/cve/CVE-2022-24769' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2066837' - url: 'https://www.cve.org/CVERecord?id=CVE-2022-24769' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-24769' - url: 'https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq' - url: 'https://access.redhat.com/errata/RHSA-2022:1357' - url: 'https://access.redhat.com/errata/RHSA-2022:2265' - url: 'https://access.redhat.com/errata/RHSA-2022:1622' - url: 'https://access.redhat.com/errata/RHSA-2022:1699' - url: 'https://access.redhat.com/errata/RHSA-2022:1370' - url: 'https://access.redhat.com/errata/RHSA-2022:1363' - url: >- https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f - url: >- https://github.com/moby/moby/commit/7f375bcff41ce672cd61e9a31f3eeb2966e3dbe1 - url: 'https://www.debian.org/security/2022/dsa-5162' - url: 'https://security.gentoo.org/glsa/202401-31' - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC - url: 'https://github.com/moby/moby/releases/tag/v20.10.14' - url: 'https://github.com/moby/moby' - url: 'http://www.openwall.com/lists/oss-security/2022/05/12/1' tags: - csaf - vex - red-hat - osv - go epss: 0.00492 epssPercentile: 0.42043 aliases: - GHSA-2mm7-x5h6-5pvq - GO-2022-0390 ecosystem: go scores: vendor: 4.8 osv: 5.9 ingestedAt: '2026-09-12T03:13:01.745Z' --- ## Overview A flaw was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. Containers using Linux users and groups to perform privilege separation inside the container are most directly impacted. ## Vendor advisories - **RHSA-2022:1357** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2022-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2022:1357) - **RHSA-2022:2265** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.6 · released 2022-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2022:2265) - **RHSA-2022:1622** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.6 · released 2022-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2022:1622) - **RHSA-2022:1699** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.7 · released 2022-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2022:1699) - **RHSA-2022:1370** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.8 · released 2022-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2022:1370) - **RHSA-2022:1363** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.9 · released 2022-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2022:1363) - **Red Hat VEX** · Moderate · affected: Migration Toolkit for Virtualization, Red Hat Advanced Cluster Security 3, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform Assisted Installer 1, Red Hat OpenShift Virtualization 2, … · no fix planned: Migration Toolkit for Virtualization, Red Hat Advanced Cluster Security 3, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-24769.json) **moby: Default inheritable capabilities for linux container should be empty** — rated Moderate by Red Hat. Released 2022-03-23, updated 2026-10-16. Affected: - Migration Toolkit for Virtualization - Red Hat Advanced Cluster Security 3 - Red Hat Enterprise Linux 7 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Container Platform Assisted Installer 1 - Red Hat OpenShift Virtualization 2 - Red Hat OpenShift Virtualization 4 - Red Hat Quay 3 Fixed: - Red Hat OpenShift Container Platform 4.10 - Red Hat OpenShift Container Platform 4.6 - Red Hat OpenShift Container Platform 4.7 - Red Hat OpenShift Container Platform 4.8 - Red Hat OpenShift Container Platform 4.9 No fix planned: - Migration Toolkit for Virtualization - Red Hat Advanced Cluster Security 3 - Red Hat Enterprise Linux 7 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Container Platform Assisted Installer 1 - Red Hat OpenShift Virtualization 2 - Red Hat OpenShift Virtualization 4 - Red Hat Quay 3 Not affected: - Red Hat OpenShift Container Platform 4.10 - Red Hat OpenShift Container Platform 4.6 - Red Hat OpenShift Container Platform 4.7 - Red Hat OpenShift Container Platform 4.8 - Red Hat OpenShift Container Platform 4.9 ## Remediation For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.10/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2022:1357 "For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html" https://access.redhat.com/errata/RHSA-2022:2265 For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html https://access.redhat.com/errata/RHSA-2022:1622 Workarounds / mitigations: - The entry point of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting. ## Package advisory (CVE-2022-24769) Affected packages: - `github.com/moby/moby < 20.10.14` - `github.com/docker/docker < 20.10.14` Patched in: - `github.com/moby/moby 20.10.14` - `github.com/docker/docker 20.10.14` Source: https://osv.dev/vulnerability/GHSA-2mm7-x5h6-5pvq