CVE-2022-27650

Name	CVE-2022-27650
Description	A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1009881

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
crun (PTS)	bullseye	0.17+dfsg-1+deb11u2	fixed
	bookworm	1.8.1-1+deb12u1	fixed
	sid, trixie	1.18.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
crun	source	bullseye	0.17+dfsg-1+deb11u1
crun	source	(unstable)	1.5+dfsg-1			1009881

https://github.com/containers/crun/commit/b847d146d496c9d7beba166fd595488e85488562 (1.4.4)