CVE-2022-36109

Severity
6.3MEDIUM
EPSS
0.0%
top 87.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 9
Latest updateAug 21

Description

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.4

Affected Packages4 packages

NVDmobyproject/moby< 20.10.18
CVEListV5moby/moby< 20.10.18
Gogithub.com/docker/docker< 20.10.18+1
Debiandocker.io< 20.10.19+dfsg1-1+2

Also affects: Fedora 36, 37

Patches

🔴Vulnerability Details

5
OSV
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker2024-08-21
GHSA
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions2022-09-16
OSV
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions2022-09-16
OSV
CVE-2022-36109: Moby is an open-source project created by Docker to enable software containerization2022-09-09
CVEList
Moby vulnerability relating to supplementary group permissions2022-09-09

📋Vendor Advisories

2
Red Hat
moby: supplementary groups mishandling2022-09-15
Debian
CVE-2022-36109: docker.io - Moby is an open-source project created by Docker to enable software containeriza...2022

📐Framework References

1
CWE
Incorrect User Management
CVE-2022-36109 (MEDIUM CVSS 6.3) | Moby is an open-source project crea | cvebase.io