CVE-2022-27651: Incorrect Default Permissions (CWE-276)
value: A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 6.8
Published: 2022-04-04T20:15Z
Repository: https://github.com/containers/buildah
Language: Go
Files changed: chroot/run.go, run_linux.go
Commit date: 2022-03-23 09:09:39 +0100
Commit message: do not set the inheritable capabilities

The kernel never sets the inheritable capabilities for a process, they
are only set by userspace.  Emulate the same behavior.

Closes: CVE-2022-27651

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Diff: diff --git a/chroot/run.go b/chroot/run.go
index badb51e34..dcfbd0f24 100644
--- a/chroot/run.go
+++ b/chroot/run.go
@@ -895,11 +895,11 @@ func setCapabilities(spec *specs.Spec, keepCaps ...string) error {
 		return errors.Wrapf(err, "error reading capabilities of current process")
 	}
 	capMap := map[capability.CapType][]string{
 		capability.BOUNDING:    spec.Process.Capabilities.Bounding,
 		capability.EFFECTIVE:   spec.Process.Capabilities.Effective,
-		capability.INHERITABLE: spec.Process.Capabilities.Inheritable,
+		capability.INHERITABLE: []string{},
 		capability.PERMITTED:   spec.Process.Capabilities.Permitted,
 		capability.AMBIENT:     spec.Process.Capabilities.Ambient,
 	}
 	knownCaps := capability.List()
 	noCap := capability.Cap(-1)
diff --git a/run_linux.go b/run_linux.go
index 794636bf4..eb9adbfb6 100644
--- a/run_linux.go
+++ b/run_linux.go
@@ -1962,13 +1962,10 @@ func setupCapAdd(g *generate.Generator, caps ...string) error {
 			return errors.Wrapf(err, "error adding %q to the bounding capability set", cap)
 		}
 		if err := g.AddProcessCapabilityEffective(cap); err != nil {
 			return errors.Wrapf(err, "error adding %q to the effective capability set", cap)
 		}
-		if err := g.AddProcessCapabilityInheritable(cap); err != nil {
-			return errors.Wrapf(err, "error adding %q to the inheritable capability set", cap)
-		}
 		if err := g.AddProcessCapabilityPermitted(cap); err != nil {
 			return errors.Wrapf(err, "error adding %q to the permitted capability set", cap)
 		}
 		if err := g.AddProcessCapabilityAmbient(cap); err != nil {
 			return errors.Wrapf(err, "error adding %q to the ambient capability set", cap)
@@ -1983,13 +1980,10 @@ func setupCapDrop(g *generate.Generator, caps ...string) error {
 			return errors.Wrapf(err, "error removing %q from the bounding capability set", cap)
 		}
 		if err := g.DropProcessCapabilityEffective(cap); err != nil {
 			return errors.Wrapf(err, "error removing %q from the effective capability set", cap)
 		}
-		if err := g.DropProcessCapabilityInheritable(cap); err != nil {
-			return errors.Wrapf(err, "error removing %q from the inheritable capability set", cap)
-		}
 		if err := g.DropProcessCapabilityPermitted(cap); err != nil {
 			return errors.Wrapf(err, "error removing %q from the permitted capability set", cap)
 		}
 		if err := g.DropProcessCapabilityAmbient(cap); err != nil {
 			return errors.Wrapf(err, "error removing %q from the ambient capability set", cap)

Vulnerable code: 		capability.INHERITABLE: spec.Process.Capabilities.Inheritable,
		if err := g.AddProcessCapabilityInheritable(cap); err != nil {
			return errors.Wrapf(err, "error adding %q to the inheritable capability set", cap)
		}
		if err := g.DropProcessCapabilityInheritable(cap); err != nil {
			return errors.Wrapf(err, "error removing %q from the inheritable capability set", cap)
		}
Fixed code: 		capability.INHERITABLE: []string{},