Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-27651

24
FAUCET Score

CVE-2022-27651 is a medium-severity vulnerability affecting Buildah and Moby (Docker Engine) where containers are incorrectly started with non-empty default or inheritable Linux process capabilities. This flaw allows an attacker with specific access to elevate existing file capabilities, potentially impacting confidentiality and integrity. The attack requires low privileges but high attack complexity, with a CVSS score of 6.8. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.25.0CPE matchmatch criteria
cpe:2.3:a:buildah_project:buildah:*:*:*:*:*:*:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
35CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
36CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.8MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.6
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.21%
Probability of exploitation in next 30 days
EPSS Percentile
65.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0121 is in the 63rd percentile among its peer group of 1,428 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (16)

github_advisorypatch availablevia nvd_reference
View patch
gopatch availablevia ghsa
Product: github.com/containers/buildahFixed in: 1.25.0
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.21.7-2
microsoftpatch availablevia msrc
Product: 19839-17086Fixed in: 1.21.7-2
microsoftpatch availablevia msrc
Product: cbl2 cri-o 1.21.7-3 on CBL Mariner 2.0Fixed in: 1.21.7-2
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.18.0-8
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.21.7-2
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.18.0-8
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: container-tools:2.0-8040020220411112506.c0c392d5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: container-tools:2.0-8020020220420173758.28c38760
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: container-tools:3.0-8040020220419093313.c0c392d5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:rhel8-8060020220401155929.2e213529
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:3.0-8050020220411083214.e34216c9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: container-tools:2.0-8050020220411114323.e34216c9
View patch
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: buildah
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: buildah

Vendor Advisories (4)

microsoft2024-Apr/CVE-2022-27651

CVE-2022-27651

Apr 9, 2024
microsoft2022-Apr/CVE-2022-27651Moderate

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.

Apr 12, 2022
goGHSA-c3g4-w6cv-6v7hmedium

Non-empty default inheritable capabilities for linux container in Buildah

Apr 1, 2022
redhatCVE-2022-27651Moderate

buildah: Default inheritable capabilities for linux container should be empty

Mar 30, 2022

References

bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory
github.com / containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
PatchThird Party Advisory
github.com / containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/25YI27MENCEPZTTGRVU6BQD5V53FNI52
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/2VWH6X6HOFPO6HTESF42HIJZEPXSWVIO
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/7NETC7I6RTMMBRJJQVJOJUPDK4W4PQSJ