CVE-2022-36109

Name	CVE-2022-36109
Description	Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1019601

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
docker.io (PTS)	bullseye	20.10.5+dfsg1-1+deb11u2	vulnerable
	bullseye (security)	20.10.5+dfsg1-1+deb11u3	vulnerable
	bookworm	20.10.24+dfsg1-1+deb12u1	fixed
	sid, trixie	26.1.5+dfsg1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
docker.io	source	(unstable)	20.10.19+dfsg1-1			1019601

Notes

[bullseye] - docker.io <no-dsa> (Minor issue)
[buster] - docker.io <no-dsa> (Minor issue)
https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4
https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32