Improper Privilege Management in moby - CVE-2022-36109

Vulnerability identifier: #VU72321

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36109

CWE-ID: CWE-269

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper privilege management caused by improper setup of supplementary groups. A local user can bypass primary group restrictions and compromise the container.

moby
Gentoo Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Containers Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
openSUSE Leap
openEuler
Fedora
containerd
Storage Ceph
IBM Cloud Pak for Multicloud Management
IBM Edge Application Manager
IBM Cloud Pak System
containerd
docker-engine
docker
moby-engine
docker-debuginfo
docker-fish-completion
docker-bash-completion
docker-zsh-completion
app-containers/docker
IBM InfoSphere Information Server

Install updates from vendor's website.

moby - update to 20.10.18
containerd - addressed in versions 1.5.18, 1.6.18
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Cloud Pak System - update to 2.3.3.6
containerd - update to 1.6.8-2
containerd - update to 1.6.8-2.fc37
Storage Ceph - update to 7.1
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 4
docker-engine - update to 18.09.0-243
docker - update to 20.10.17-1
moby-engine - addressed in versions 20.10.18-1.fc36, 20.10.18-1.fc37
docker - addressed in versions 20.10.23_ce-98.89.1, 20.10.23_ce-150000.175.1
docker-debuginfo - addressed in versions 20.10.23_ce-98.89.1, 20.10.23_ce-150000.175.1
docker-fish-completion - update to 20.10.23_ce-150000.175.1
docker-bash-completion - update to 20.10.23_ce-150000.175.1
docker-zsh-completion - update to 20.10.23_ce-150000.175.1
app-containers/docker - update to 25.0.4

• https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4
• https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32
• https://github.com/moby/moby/releases/tag/v20.10.18
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU/

• Privilege escalation in Moby
• Multiple vulnerabilities in containerd
• SUSE update for docker
• SUSE update for docker
• SUSE update for docker
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Edge Application Manager
• IBM Cloud Pak System update for Moby
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler update for docker
• Amazon Linux AMI update for containerd
• Amazon Linux AMI update for docker
• Multiple vulnerabilities in IBM Storage Ceph
• Gentoo update for Docker
• Fedora 37 update for containerd, moby-engine
• Fedora 36 update for moby-engine
• Multiple vulnerabilities in IBM InfoSphere Information Server