Containers
Monthly
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
crun versions 1.19 through 1.26 misparse the `-u` (--user) option during container execution, causing a numeric UID value of 1 to be incorrectly interpreted as UID 0 (root) instead, resulting in privilege escalation where containerized processes execute with root privileges instead of the intended unprivileged user. The vulnerability affects the containers/crun OCI runtime container (cpe:2.3:a:containers:crun:*:*:*:*:*:*:*:*) and has been patched in version 1.27. No public exploit code or active exploitation has been identified, though the EPSS score of 0.01% (percentile 2%) indicates minimal real-world exploitation likelihood despite the privilege escalation tag.
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the containers crate before 0.9.11 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Alpine Linux: aardvark-dns fixed in 1.12.2-r0
Alpine Linux: buildah fixed in 1.37.4-r0
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
crun versions 1.19 through 1.26 misparse the `-u` (--user) option during container execution, causing a numeric UID value of 1 to be incorrectly interpreted as UID 0 (root) instead, resulting in privilege escalation where containerized processes execute with root privileges instead of the intended unprivileged user. The vulnerability affects the containers/crun OCI runtime container (cpe:2.3:a:containers:crun:*:*:*:*:*:*:*:*) and has been patched in version 1.27. No public exploit code or active exploitation has been identified, though the EPSS score of 0.01% (percentile 2%) indicates minimal real-world exploitation likelihood despite the privilege escalation tag.
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the containers crate before 0.9.11 for Rust. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Alpine Linux: aardvark-dns fixed in 1.12.2-r0
Alpine Linux: buildah fixed in 1.37.4-r0