CVE-2022-2990
published 2022-09-13CVE-2022-2990: An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data…
PriorityP432high7.1CVSS 3.1
AVLACLPRLUINSUCHIHAN
EPSS
0.33%
25.6th percentile
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| buildah_project | buildah | < 1.27.1 | 1.27.1 |
| buildah_project | buildah | — | — |
| debian | golang-github-containers-buildah | < golang-github-containers-buildah 1.28.0+ds1-2 (bookworm) | golang-github-containers-buildah 1.28.0+ds1-2 (bookworm) |
| github.com | containerd_containerd | >= 0 < 1.5.18 | 1.5.18 |
| github.com | containerd_containerd | >= 1.6.0 < 1.6.18 | 1.6.18 |
| github.com | containers_buildah | >= 0 < 1.27.1 | 1.27.1 |
| msrc | azl3_buildah_1.18.0-24_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
ghsa7.1HIGH
osv7.1HIGH
vendor_debian7.1HIGH
vendor_msrc7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Supplementary groups are not set up properly in github.com/containerd/containerd
osv·2023-02-16·CVSS 7.1
CVE-2023-25173 [HIGH] Supplementary groups are not set up properly in github.com/containerd/containerd
Supplementary groups are not set up properly in github.com/containerd/containerd
### Impact
A bug was found in containerd where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.
Downstream applications that use the containerd client library may be affected as well.
### Patches
This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that
GHSA
Supplementary groups are not set up properly in github.com/containerd/containerd
ghsa·2023-02-16·CVSS 7.1
CVE-2023-25173 [HIGH] CWE-269 Supplementary groups are not set up properly in github.com/containerd/containerd
Supplementary groups are not set up properly in github.com/containerd/containerd
### Impact
A bug was found in containerd where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.
Downstream applications that use the containerd client library may be affected as well.
### Patches
This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that
OSV
Unauthorized file access in github.com/containers/buildah
osv·2022-09-21
CVE-2022-2990 Unauthorized file access in github.com/containers/buildah
Unauthorized file access in github.com/containers/buildah
SGID programs executed in a container can access files that have negative group permissions for the user's primary group.
Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1.
A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes.
A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file.
Buildah does not co
OSV
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
osv·2022-09-14
CVE-2022-2990 [HIGH] Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
GHSA
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
ghsa·2022-09-14
CVE-2022-2990 [HIGH] CWE-842 Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
OSV
CVE-2022-2990: An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data
osv·2022-09-13·CVSS 7.1
CVE-2022-2990 [HIGH] CVE-2022-2990: An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Microsoft
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to t
vendor_msrc·2022-09-13·CVSS 7.1
CVE-2022-2990 [HIGH] CWE-842 An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to t
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publi
Red Hat
buildah: possible information disclosure and modification
vendor_redhat·2022-08-22·CVSS 7.1
CVE-2022-2990 [HIGH] CWE-842 buildah: possible information disclosure and modification
buildah: possible information disclosure and modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Package: buildah (Red Hat Enterprise Linux 7) - Fix deferre
Debian
CVE-2022-2990: golang-github-containers-buildah - An incorrect handling of the supplementary groups in the Buildah container engin...
vendor_debian·2022·CVSS 7.1
CVE-2022-2990 [HIGH] CVE-2022-2990: golang-github-containers-buildah - An incorrect handling of the supplementary groups in the Buildah container engin...
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Scope: local
bookworm: resolved (fixed in 1.28.0+ds1-2)
bullseye: open
forky: resolved (fixed in 1.28.0+ds1-2)
sid: resolved (fixed in 1.28.0+ds1-2)
trixie: resolved (fixed in 1.28.0+ds1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2121453https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/https://bugzilla.redhat.com/show_bug.cgi?id=2121453https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
2022-09-13
Published