Andrew G. Morgan

**Name of the Vulnerable Software and Affected Versions** runc versions prior to 1.1.2 **Description** A bug was found in runc where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. **Recommendations** For versions prior to 1.1.2, update to version 1.1.2 to fix the bug, which changes `runc exec --cap` behavior to not include inheritable capabilities and modifies `runc spec` to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

**Name of the Vulnerable Software and Affected Versions** cri-o versions prior to v1.24.0 **Description** A flaw was found in cri-o where containers were incorrectly started with non-empty default permissions, allowing an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This bug creates an atypical Linux environment, enabling programs with inheritable file capabilities to elevate those capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. **Recommendations** For versions prior to v1.24.0, update to version v1.24.0 or later as soon as possible. After updating, stop, delete, and recreate running containers to reset the inheritable capabilities. As a temporary workaround, consider modifying the entrypoint of a container to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.

**Name of the Vulnerable Software and Affected Versions** Moby (Docker Engine) versions prior to 20.10.14 **Description** A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. **Recommendations** To resolve the issue, update to Moby (Docker Engine) version 20.10.14 or later. For versions prior to 20.10.14, stop, delete, and recreate running containers to reset the inheritable capabilities. As a temporary workaround, consider modifying the entry point of a container to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.