High severity · published Sep 19, 2022
CVE-2022-2995
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct…
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Cri-o · Kubernetes
1.25.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2995
Patch
https://github.com/cri-o/cri-o/pull/6159
Exploit
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
More from Cri-o
8.8
CVE-2022-0811
A flaw was found in CRI-O in the way it set kernel options for a pod
8.8
CVE-2018-1000400
Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers…
8.1
CVE-2024-5154
A flaw was found in cri-o
7.8
CVE-2022-4318
A vulnerability was found in cri-o
7.5
CVE-2022-1708
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API