CVE-2022-2989 Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
Incorrect supplementary group handling in Podman allows attackers with container access to disclose sensitive information or modify data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2989?
CVE-2022-2989 is a high-severity missing authorization vulnerability in Redhat Enterprise Linux, published on 13 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Which versions are affected by CVE-2022-2989?
4 open source packages ship an affected version, including github.com/containers/podman/v3 and github.com/containers/podman/v4. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/podman/v3 Go | All versions | 3.0.1 |
github.com/containers/podman/v3 Go | All versions | 3.0.1 |
github.com/containers/podman/v4 Go | All versions | 4.2.0 |
github.com/containers/podman/v4 Go | All versions | 4.2.0 |
Linux distribution packages (10)
podman SUSE:Enterprise Storage 7.1 | All versions | 3.4.7-150300.9.12.1 |
podman SUSE:Linux Enterprise Micro 5.1 | All versions | 3.4.7-150300.9.12.1 |
podman SUSE:Linux Enterprise Micro 5.2 | All versions | 3.4.7-150300.9.12.1 |
podman SUSE:Linux Enterprise Micro 5.3 | All versions | 3.4.7-150400.4.6.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP3 | All versions | 3.4.7-150300.9.12.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP4 | All versions | 3.4.7-150400.4.6.1 |
podman openSUSE:Leap 15.3 | All versions | 3.4.7-150300.9.12.1 |
podman openSUSE:Leap 15.4 | All versions | 3.4.7-150400.4.6.1 |
podman openSUSE:Leap Micro 5.2 | All versions | 3.4.7-150300.9.12.1 |
podman openSUSE:Tumbleweed | All versions | 4.3.1-1.1 |
Products include Podman Project Podman, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2022-2989?
Upgrade github.com/containers/podman/v3 to 3.0.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-2989 being exploited?
There is no known exploitation of CVE-2022-2989 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-57231 Podman: Malformed Image can trick podman run into leaking host environment variables into the container
- CVE-2022-2738 Use after free in podman
- CVE-2021-20188 Improper Authorization in github.com/containers/libpod
- CVE-2023-0778 Podman Time-of-check Time-of-use (TOCTOU) Race Condition
- CVE-2019-25067 Podman/Varlink API Privilege Escalation
Sources
Also known as AZL-10964, AZL-36976, DEBIAN-CVE-2022-2989, GHSA-4wjj-jwc9-2x96, MINI-mfpq-732q-x432, MINI-vvcp-v9mc-r83c and 5 more.