| Project | docker-image|docker.io/redis |
|---|---|
| Path | docker.io/redis:8.8.0-alpine/redis |
| Package Manager | apk |
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Remediation
Upgrade Alpine:3.23 zlib to version 1.3.2-r1 or higher.
References
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://github.com/madler/zlib
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
Missing Release of File Descriptor or Handle after Effective Lifetime
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.
Remediation
Upgrade Alpine:3.23 util-linux to version 2.41.6-r1 or higher.
References
- https://access.redhat.com/security/cve/CVE-2026-78408
- https://bugzilla.redhat.com/show_bug.cgi?id=2522497
- https://access.redhat.com/errata/RHSA-2026:63162
- http://www.openwall.com/lists/oss-security/2026/09/05/2
- https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj
Detection of Error Condition Without Action
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.
Remediation
Upgrade Alpine:3.23 util-linux to version 2.41.6-r0 or higher.
References
- https://github.com/util-linux/util-linux
- https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476
- https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892
- https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a
- https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc
- https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf
- https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper
- https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f
Time-of-check Time-of-use (TOCTOU)
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
Remediation
Upgrade Alpine:3.23 util-linux to version 2.41.6-r0 or higher.
References
- https://access.redhat.com/security/cve/CVE-2026-78410
- https://bugzilla.redhat.com/show_bug.cgi?id=2522684
- https://access.redhat.com/errata/RHSA-2026:63162
- https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m