CVE-2022-29162 — Incorrect Default Permissions in runc

Description

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

Affected products

Vendor	Product	Affected	Fixed
opencontainers	runc	< 1.1.2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	runc	1.1.3+ds1-1	—
Debian 13	runc	1.1.3+ds1-1	—
Debian 12	runc	1.1.3+ds1-1	—
Debian 10	runc	1.0.0~rc6+dfsg1-3+deb10u2	DLA-3369-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	runc	1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4	USN-6088-2

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 9	runc	4:1.1.4-1.el9	RHSA-2022:8090
RHEL 8	buildah +1	1:1.24.5-2.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	cockpit-podman	46-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	conmon	2:2.1.4-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	container-selinux	2:2.189.0-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	containernetworking-plugins	1:1.1.1-2.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	containers-common	2:1-35.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	crit +4	3.15-3.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	crun	1.5-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	fuse-overlayfs	1.9-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	libslirp +1	4.4.0-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	netavark +1	2:1.0.1-35.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	oci-seccomp-bpf-hook	1.2.5-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	podman +6	2:4.0.2-8.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	python-podman +1	4.0.0-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	runc	1:1.1.4-1.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	skopeo +1	2:1.6.2-5.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	slirp4netns	1.1.8-2.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	toolbox +1	0.0.99.3-0.5.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457
RHEL 8	udica	0.2.6-3.module+el8.7.0+16520+2db5507d	RHSA-2022:7469, RHSA-2022:7457

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Openshift Ironic 4	libsodium +2	1.0.16-5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	openstack-ironic +4	1:20.2.1-0.20220628175043.b5ed57a.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	openstack-ironic-inspector +4	10.12.1-0.20220513095437.6dd37e5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	pycdlib-tools +2	1.11.0-4.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	pyparsing +2	2.3.1-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	pysnmp +1	4.4.8-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-SecretStorage +1	2.3.1-9.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-alembic +1	1.4.2-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-amqp +2	2.5.2-8.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-appdirs +1	1.4.0-8.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-automaton +1	2.5.0-0.20220509195848.aaca110.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-bcrypt +1	3.1.6-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-beautifulsoup4 +1	4.9.3-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-cachetools +1	3.1.0-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-cinderclient +1	8.3.0-0.20220509212734.ee59b68.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-cliff +2	3.10.1-0.20220509200732.a04a48f.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-colorama +1	0.4.1-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-construct +1	2.10.56-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-dataclasses +1	0.8-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-debtcollector +1	2.5.0-0.20220509211533.a6b46c5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-decorator +1	4.4.0-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-dogpile-cache +1	1.1.2-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-dracclient +1	8.0.0-0.20220509201613.9c7499c.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-editor +1	1.0.4-5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-fasteners +1	0.14.1-21.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-flask +2	1:1.1.1-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-funcsigs +1	1.0.2-17.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-futurist +1	2.4.1-0.20220509215250.159d752.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-glanceclient +1	1:3.6.0-0.20220509212414.626c500.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-greenlet +2	0.4.14-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-hardware +2	0.29.0-0.20220216015636.7662a1d.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-ifaddr +1	0.1.6-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-importlib-metadata +1	1.7.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-ironic-lib +1	5.1.1-0.20220225151335.e205816.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-ironic-prometheus-exporter +1	3.1.1-0.20220324125409.db1a824.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-iso8601 +1	0.1.12-9.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-jsonpath-rw +1	1.2.3-23.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-jsonschema +1	3.2.0-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-kazoo +1	2.7.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-keyring +1	21.0.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-keystoneauth1 +1	4.5.0-0.20220509213157.8da0a63.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-keystoneclient +2	1:4.4.0-0.20220509200759.100253d.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-keystonemiddleware +1	9.4.0-0.20220509211054.8a05709.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-kombu +1	1:4.6.6-8.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-logutils +1	0.3.5-7.1.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-memcached +1	1.58-12.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-migrate +1	0.13.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-msgpack +1	0.6.2-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-munch +1	2.3.2-7.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-openstacksdk +2	0.61.0-0.20220509201549.26c9bc2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-os-service-types +1	1.7.0-0.20220215231659.0b2f473.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-os-traits +2	2.7.0-0.20220509205801.3d1dbf0.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-osc-lib +2	2.5.0-0.20220509211843.78d276e.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-cache +3	2.8.1-0.20220216000746.40946a9.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-concurrency +3	4.5.1-0.20220509221157.145f060.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-config +1	2:8.8.0-0.20220509202553.64c82a0.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-context +2	4.1.0-0.20220509205437.3400cc2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-db +3	9.1.0-0.20220216003829.be2cc6a.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-i18n +2	5.1.0-0.20220216011159.b031d17.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-log +3	4.6.0-0.20220216002407.41c8807.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-messaging +2	12.13.0-0.20220509210748.2d090b5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-metrics +2	0.3.0-0.20220216012738.43eee50.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-middleware +3	4.5.1-0.20220509203328.2f72b30.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-policy +3	3.12.1-0.20220509221328.9673a74.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-rootwrap +2	6.3.1-0.20220509204453.1b1b960.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-serialization +2	4.3.0-0.20220509195921.6910f75.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-service +2	2.8.0-0.20220509203713.6552b9a.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-upgradecheck +1	1.5.0-0.20220509195112.1559e03.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-utils +3	4.13.0-0.20220509213520.de4429f.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-oslo-versionedobjects +3	2.6.0-0.20220509202736.25d34d6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-osprofiler +1	3.4.3-0.20220509214403.3286301.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-packaging +2	20.4-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-paste +1	3.2.4-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-paste-deploy +1	2.0.1-5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pbr +1	5.5.1-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pecan +1	1.3.2-10.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pexpect +1	4.6-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pint +1	0.10.1-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-proliantutils +1	2.13.2-0.20220509214147.8c7b6b1.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-prometheus_client +1	0.7.1-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pycadf +2	3.1.1-0.20220215232623.4179996.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pynacl +1	1.3.0-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pyperclip +2	1.6.4-7.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-pyrsistent +1	0.16.0-4.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-redis +1	3.3.8-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-repoze-lru +1	0.7-7.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-requestsexceptions +1	1.4.0-0.20220215231659.d7ac0ff.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-retrying +1	1.2.3-22.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-rfc3986 +1	1.2.0-6.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-routes +1	2.4.1-12.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-scciclient	0.11.1-0.20220216020832.a84332b.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-simplegeneric	0.8.1-18.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-simplejson	3.17.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-singledispatch	3.4.0.3-19.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-six	1.15.0-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-soupsieve	2.1.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-sqlparse	0.2.4-10.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-statsd	3.2.1-17.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-stevedore	3.5.0-0.20220509195112.442f157.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-sushy	4.1.1-0.20220302175405.c769149.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-sushy-oem-idrac	4.0.0-0.20220324125409.7b75e6e.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-swiftclient	3.13.1-0.20220509204112.4989d94.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-tempita	0.5.1-25.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-tenacity	6.2.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-tooz	2.11.1-0.20220509215238.96f91b9.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-vine	1.3.0-5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-voluptuous	0.11.7-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-waitress	2.0.0-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-warlock	1.3.3-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-wcwidth	0.1.7-15.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-webob	1.8.5-5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-webtest	2.0.33-5.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-werkzeug	2.0.3-1.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-wrapt +1	1.11.2-4.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-wsme	0.11.0-0.20220216004816.80bda90.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-yappi	1.0-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-zake	0.2.2-19.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-zeroconf	0.24.4-2.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python-zipp	0.5.1-3.el8	RHSA-2022:5068
Red Hat Openshift Ironic 4	python3-ironic-python-agent +1	8.6.1-0.20220623075054.1d50c23.el8	RHSA-2022:5068
Red Hat OpenShift 4	afterburn +1	5.3.0-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	atomic-openshift-service-idler	4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8	RHSA-2022:5068
Red Hat OpenShift 4	bootupd +1	0.2.5-3.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	buildah +1	1:1.23.4-2.el8	RHSA-2022:5068
Red Hat OpenShift 4	butane +1	0.15.0-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	conmon	2:2.1.2-2.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	console-login-helper-messages +2	0.20.3-2.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	container-selinux	2:2.188.0-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	containernetworking-plugins	1.0.1-5.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	containers-common	2:1-21.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	coreos-installer +1	0.15.0-2.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	cri-o	1.24.1-11.rhaos4.11.gitb0d2ef3.el8	RHSA-2022:5068
Red Hat OpenShift 4	cri-tools	1.24.2-4.1.el8	RHSA-2022:5068
Red Hat OpenShift 4	crit +4	3.15-4.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	crun	1.4.2-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	fuse-overlayfs	1.9-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	haproxy +1	2.2.24-1.el8	RHSA-2022:5068
Red Hat OpenShift 4	ignition +1	2.14.0-3.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	kata-containers	2.4.2-1.el8	RHSA-2022:5068
Red Hat OpenShift 4	libslirp +1	4.4.0-2.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	openshift +1	4.11.0-202207082037.p0.g9546431.assembly.stream.el8	RHSA-2022:5068
Red Hat OpenShift 4	openshift-ansible +1	4.11.0-202206240216.p0.g9de1722.assembly.stream.el8	RHSA-2022:5068
Red Hat OpenShift 4	openshift-clients +1	4.11.0-202207291716.p0.g7075089.assembly.stream.el8	RHSA-2022:5068
Red Hat OpenShift 4	openshift-kuryr +4	4.11.0-202206232036.p0.g66c0cec.assembly.stream.el8	RHSA-2022:5068
Red Hat OpenShift 4	openvswitch2.17 +5	2.17.0-22.el8fdp	RHSA-2022:5068
Red Hat OpenShift 4	ovn22.03 +3	22.03.0-37.el8fdp	RHSA-2022:5068
Red Hat OpenShift 4	ovn22.06 +3	22.06.0-27.el8fdp	RHSA-2022:5068
Red Hat OpenShift 4	podman +5	2:4.0.2-6.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	runc	3:1.1.2-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	skopeo +1	2:1.5.2-3.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	slirp4netns	1.1.8-1.rhaos4.11.el8	RHSA-2022:5068
Red Hat OpenShift 4	toolbox	0.0.9-1.rhaos4.11.el8	RHSA-2022:5068

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	runc	4:1.1.4-1.el9	ALSA-2022:8090
AlmaLinux 8	buildah +1	1:1.24.5-2.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	cockpit-podman	46-1.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	conmon	2:2.1.4-1.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	container-selinux	2:2.189.0-1.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	containernetworking-plugins	1:1.1.1-2.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	containers-common	2:1-35.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	crit +4	3.15-3.module_el8.6.0+2877+8e437bf5	ALSA-2022:7469
AlmaLinux 8	crun	1.5-1.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	fuse-overlayfs	1.9-1.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	libslirp +1	4.4.0-1.module_el8.6.0+2877+8e437bf5	ALSA-2022:7469
AlmaLinux 8	netavark +1	2:1.0.1-35.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	oci-seccomp-bpf-hook	1.2.5-1.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	podman +6	2:4.0.2-8.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	python3-podman	4.0.0-1.module_el8.6.0+2877+8e437bf5	ALSA-2022:7469
AlmaLinux 8	runc	1:1.1.4-1.module_el8.7.0+3344+484dae7b	ALSA-2022:7469
AlmaLinux 8	skopeo +1	2:1.6.2-5.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	slirp4netns	1.1.8-2.module_el8.6.0+2877+8e437bf5	ALSA-2022:7469
AlmaLinux 8	toolbox +1	0.0.99.3-0.5.module_el8.7.0+3344+5bcd850f	ALSA-2022:7469
AlmaLinux 8	udica	0.2.6-3.module_el8.6.0+2886+d33c3efb	ALSA-2022:7469

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	runc	4:1.1.4-1.el9_1	RLSA-2022:8090
Rocky Linux 8	buildah	1:1.24.5-2.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469
Rocky Linux 8	cockpit-podman	46-1.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	conmon	2:2.1.4-1.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	container-selinux	2:2.189.0-1.module+el8.6.0+1054+50b00ff4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	containernetworking-plugins	1:1.1.1-2.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	containers-common	2:1-35.module+el8.6.0+997+05c9d812	RLSA-2022:7469
Rocky Linux 8	criu	3.15-3.module+el8.5.0+710+4c471e88	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	crun	1.5-1.module+el8.6.0+1054+50b00ff4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	fuse-overlayfs	1.9-1.module+el8.6.0+1054+50b00ff4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	libslirp	4.4.0-1.module+el8.5.0+710+4c471e88	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	oci-seccomp-bpf-hook	1.2.5-1.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	podman	2:4.0.2-8.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469
Rocky Linux 8	python-podman	4.0.0-1.module+el8.6.0+784+32aef5de	RLSA-2022:7469
Rocky Linux 8	runc	1:1.1.4-1.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	skopeo	2:1.6.2-5.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469
Rocky Linux 8	slirp4netns	1.1.8-2.module+el8.6.0+784+32aef5de	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	toolbox	0.0.99.3-0.5.module+el8.7.0+1077+0e4f03d4	RLSA-2022:7469, RLSA-2022:7457
Rocky Linux 8	udica	0.2.6-3.module+el8.6.0+971+69b94baf	RLSA-2022:7469, RLSA-2022:7457

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES 15 SP4	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES 15 SP4	kubevirt	0.54.0-150400.3.3.2	SUSE-SU-2022:3333-1
SLES 15 SP4	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLES 15 SP3	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES 15 SP3	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES 15 SP3	kubevirt	0.49.0-150300.8.13.1	SUSE-SU-2022:3321-1
SLES 15 SP3	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLES 15 SP2	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES 15 SP2	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES 15 SP2	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLES 15 SP1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES 15 SP1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES 15 SP1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLES 15	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES 15	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES 15	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1

Show 15 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12	containerd	1.6.6-16.62.1	SUSE-SU-2022:2165-1
SLES 12	docker	20.10.17_ce-98.83.1	SUSE-SU-2022:2165-1
SLES 12	runc	1.1.3-16.21.1	SUSE-SU-2022:2165-1
SLES for SAP 15 SP2	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES for SAP 15 SP2	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES for SAP 15 SP2	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLES for SAP 15 SP1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES for SAP 15 SP1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES for SAP 15 SP1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLES for SAP 15	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLES for SAP 15	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLES for SAP 15	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLE Micro 5.2	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLE Micro 5.2	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLE Micro 5.2	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLE Micro 5.1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLE Micro 5.1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLE Micro 5.1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLE HPC 15 SP2	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLE HPC 15 SP2	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLE HPC 15 SP2	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLE HPC 15 SP1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLE HPC 15 SP1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLE HPC 15 SP1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SLE HPC 15	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SLE HPC 15	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SLE HPC 15	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SUSE Manager Server 4.1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SUSE Manager Server 4.1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SUSE Manager Server 4.1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SUSE Manager Retail Branch Server 4.1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SUSE Manager Retail Branch Server 4.1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SUSE Manager Retail Branch Server 4.1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SUSE Manager Proxy 4.1	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SUSE Manager Proxy 4.1	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SUSE Manager Proxy 4.1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 7.1	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 7	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 7	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 7	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 6	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 6	docker	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
SUSE Enterprise Storage 6	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	govulncheck-vulndb	0.0.20250807T150727-1.1	openSUSE-SU-2025:15424-1
openSUSE Tumbleweed	runc	1.1.2-1.1	openSUSE-SU-2024:12074-1
openSUSE Leap 15.4	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
openSUSE Leap 15.4	docker +1	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
openSUSE Leap 15.4	kubevirt	0.54.0-150400.3.3.2	SUSE-SU-2022:3333-1
openSUSE Leap 15.4	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1
openSUSE Leap 15.3	containerd	1.6.6-150000.73.2	SUSE-SU-2022:2341-1
openSUSE Leap 15.3	docker +1	20.10.17_ce-150000.166.1	SUSE-SU-2022:2341-1
openSUSE Leap 15.3	kubevirt	0.49.0-150300.8.13.1	SUSE-SU-2022:3321-1
openSUSE Leap 15.3	runc	1.1.3-150000.30.1	SUSE-SU-2022:2341-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	runc	1.1.2-r0	—
Alpine v3.23	runc	1.1.2-r0	—
Alpine v3.22	runc	1.1.2-r0	—
Alpine v3.21	runc	1.1.2-r0	—
Alpine v3.20	runc	1.1.2-r0	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	runc	1.1.2-r0	—
Alpine v3.18	runc	1.1.2-r0	—
Alpine v3.17	runc	1.1.2-r0	—
Alpine v3.16	runc	1.1.2-r0	—
Alpine v3.15	runc	1.1.2-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	runc	1.1.3-1.amzn2023.0.2	ALAS2023-2024-531

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 2 (CBL-Mariner)	moby-runc	1.1.2-2	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	runc	4:1.1.4-1.el9	ELSA-2022-8090
Oracle Linux 8	buildah +1	1:1.24.5-2.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	cockpit-podman	46-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	conmon	2:2.1.4-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	container-selinux	2:2.189.0-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	containernetworking-plugins	1:1.1.1-2.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	containers-common	2:1-35.0.1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	crit +4	3.15-3.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	crun	1.5-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	fuse-overlayfs	1.9-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	libslirp +1	4.4.0-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	netavark +1	2:1.0.1-35.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	oci-seccomp-bpf-hook	1.2.5-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	podman +6	2:4.0.2-8.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	python3-podman	4.0.0-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	runc	1:1.1.4-1.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	skopeo +1	2:1.6.2-5.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	slirp4netns	1.1.8-2.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457
Oracle Linux 8	udica	0.2.6-3.module+el8.7.0+20872+81cbf159	ELSA-2022-7469, ELSA-2022-7457

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	ctop	0.7.7-r13	—
Wolfi rolling	podman +1	5.2.2-r1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/opencontainers/runc	< 1.1.2	1.1.2	GHSA-f3fp-gc8g-vw66

Advisories 25

ALSA-2022:8090 Low: runc security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2022:7469 Moderate: container-tools:4.0 security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2022:5068 Red Hat Security Advisory: OpenShift Container Platform 4.11.0 packages and security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2022:7469 Red Hat Security Advisory: container-tools:4.0 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2022:7457 Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
RHSA-2022:8090 Red Hat Security Advisory: runc security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
USN-6088-2 runc vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
DLA-3369-1 runc - security update Debian Security (DSA / DLA) · Mar 9, 2026
RLSA-2022:8090 Low: runc security update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2022:7457 Moderate: container-tools:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
RLSA-2022:7469 Moderate: container-tools:4.0 security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
SUSE-SU-2022:2341-1 Security update for containerd, docker and runc SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12074-1 runc-1.1.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:2165-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3321-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3333-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2022-2052 Mehrere Red Hat Enterprise Linux Pakete: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 29, 2025
ALAS2023-2024-531 Low: runc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 19, 2024
ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
ELSA-2022-8090 Low: runc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022
ELSA-2022-7469 Moderate: container-tools:4.0 security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 15, 2022
ELSA-2022-7457 Moderate: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 15, 2022

References

https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66
https://github.com/opencontainers/runc/commit/d04de3a9b72d7a2455c1885fc75eb36d02cd17b5
https://github.com/opencontainers/runc/releases/tag/v1.1.2
FEDORA-2022-91b747a0d7 vendor-advisory
FEDORA-2022-e980dc71b1 vendor-advisory
FEDORA-2022-d1f55f8fd0 vendor-advisory
[debian-lts-announce] 20230327 [SECURITY] [DLA 3369-1] runc security update mailing-list

CNA	v3.1	5.9
EUVD	v3.1	5.9
OSV:GHSA	v3.1	5.9