Read the docs
TI-2022-11706 Aliases CVE-2022-29162GHSA-f3fp-gc8g-vw66

Incorrect Default Permissions in runc

Priority LOW 34CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Partial runc (opencontainers): 1.1.2github.com/opencontainers/runc (Go): 1.1.2Red Hat: 4 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageruncbefore 1.1.21.1.2Patch availableCNA
—github.com/opencontainers/runc (Go)before 1.1.21.1.2Patch availableGHSA-f3fp-gc8g-vw66
  • runc Vendorbackstage Affected before 1.1.2 Fixed in 1.1.2 Patch available CNA
  • github.com/opencontainers/runc (Go) Vendor— Affected before 1.1.2 Fixed in 1.1.2 Patch available GHSA-f3fp-gc8g-vw66

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*before 1.1.2Vulnerablebackstage
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* Versions before 1.1.2 Vulnerable ·backstage
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA runc (opencontainers) Fixed in 1.1.2
  • Fix · GHSA-f3fp-gc8g-vw66 github.com/opencontainers/runc (Go) Fixed in 1.1.2 Advisory →

Red Hat 4 advisories

  • RHSA-2022:8090 Released 2022-11-15 · Red Hat rating Low
    runc security update
    • Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.4-1.el9
  • RHSA-2022:7469 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.s390x::container-tools:4.0 +47
  • RHSA-2022:7457 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.s390x::container-tools:rhel8 +47
Show 1 more Red Hat advisories
  • RHSA-2022:5068 Released 2022-08-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.0 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.11 libsodium-1.0.16-5.el8, libsodium-devel-1.0.16-5.el8, libsodium-static-1.0.16-5.el8 +47
    • Red Hat OpenShift Container Platform 4.11 afterburn-5.3.0-1.rhaos4.11.el8, atomic-openshift-service-idler-4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8, bootupd-0.2.5-3.rhaos4.11.el8 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7457, RHSA-2022:7469
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8090
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2022:5068
Not affected: 2 products
  • Ironic content for Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29162
  2. 2026-10-03 Alias added: GHSA-f3fp-gc8g-vw66

References

Patch 1

Advisory 6

Other 4

  • TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
  • TI-2024-14351 runc container breakout through process.cwd trickery and leaked fds CVSS 3.1HIGH 8.6
  • TI-2021-10869 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. CVSS 3.1HIGH 8.5
  • TI-2019-12591 runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows… CVSS 3.1HIGH 7.5
  • TI-2025-32660 container escape due to /dev/console mount and related races CVSS 4.0HIGH 8.4
  • TI-2025-22394 runc container escape via "masked path" abuse due to mount race conditions CVSS 4.0HIGH 7.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences