High severity · published Sep 13, 2022
CVE-2022-2990
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker…
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Buildah · Buildah Project
before 1.27.1 · source: NVD
EL
Enterprise Linux · Redhat
7.0; 8.0; 9.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2990
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2990
Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=2121453
Exploit
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
More from Buildah
8.8
CVE-2020-10696
A path traversal flaw was found in Buildah in versions before 1.14.5
6.8
CVE-2022-27651
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions
5.9
CVE-2019-10214
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not…
5.5
CVE-2021-3602
An information disclosure flaw was found in Buildah, when building containers using chroot isolation
4.4
CVE-2024-9675
A vulnerability was found in Buildah