GHSA-2mm7-x5h6-5pvq CVE-2022-24769 GO-2022-0390

Moby (Docker Engine) started with non-empty inheritable Linux process capabilities

Medium Go

Severity: 5.9 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.49%; Chance of exploitation in the next 30 days. Higher than 42.26% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-732 Incorrect Permission Assignment for Critical Resource
Fix: Available; 2 packages have a fixed version

Description

Impact

A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.

Patches

This bug has been fixed in Moby (Docker Engine) 20.10.14. Users should update to this version as soon as possible. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset.

This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. Refer to capabilities(7) for a description of how capabilities work. Note that permitted file capabilities continue to allow for privileges to be raised up to the container's bounding set and that processes may add capabilities to their own inheritable set up to the container's bounding set per the rules described in the manual page. In all cases the container's bounding set provides an upper bound on the capabilities that can be assumed and provides for the container security sandbox.

Workarounds

The entrypoint of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.

Credits

The Moby project would like to thank Andrew G. Morgan for responsibly disclosing this issue in accordance with the Moby security policy.

For more information

If you have any questions or comments about this advisory:

Open an issue
Email us at security@docker.com if you think you’ve found a security bug

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/docker/docker	`< 20.10.14`	`20.10.14`
github.com/docker/docker	`< 20.10.14+incompatible`	`20.10.14+incompatible`
github.com/moby/moby	`< 20.10.14`	`20.10.14`
github.com/moby/moby	`< 20.10.14+incompatible`	`20.10.14+incompatible`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/docker/docker Go → `20.10.14`

go

go get github.com/docker/docker@v20.10.14 && go mod tidy

github.com/moby/moby Go → `20.10.14`

go

go get github.com/moby/moby@v20.10.14 && go mod tidy

Severity breakdown

CVSS 3.1 5.9

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Weakness

CWE-732: Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

How to prevent it

Implementation: When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]
Architecture and Design, Operation: Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Implementation, Installation: During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
System Configuration: For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
Documentation: Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
Installation: Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.
Operation, System Configuration: Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2022-24769

Packages

github.com/moby/moby

Timeline

Apr 22, 2024 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path	High	Also affects github.com/docker/docker
GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap	Medium	Also affects github.com/docker/docker
GHSA-x86f-5xw2-fm2r Docker: `PUT /containers/{id}/archive` executes container binary on the host	High	Also affects github.com/docker/docker
GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies	High	Also affects github.com/docker/docker
GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation	High	Also affects github.com/docker/docker
GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation	Medium	Also affects github.com/docker/docker
GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts	Medium	Also affects github.com/docker/docker
GHSA-v23v-6jw2-98fq Authz zero length regression	Critical	Also affects github.com/docker/docker

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor