Description
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
References (2)
Core 2
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2121445
Exploit, Third Party Advisory x_refsource_misc
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
Scores
CVSS v3
7.1
EPSS
0.0005
EPSS Percentile
14.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-842
CWE-863
Status
published
Products (8)
containers/podman
0 - 3.0.1Go
containers/podman
0 - 4.2.0Go
podman_project/podman
redhat/enterprise_linux
7.0
redhat/enterprise_linux
8.0
redhat/enterprise_linux
9.0
redhat/openshift_container_platform
3.11
redhat/openshift_container_platform
4.0
Published
Sep 13, 2022
Tracked Since
Feb 18, 2026