CVE-2022-2995 CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure

What is CVE-2022-2995?

CVE-2022-2995 is a high-severity missing authorization vulnerability in cri-o, published on 19 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Weakness: CWE-732, CWE-284

Which versions are affected by CVE-2022-2995?

3 open source packages ship an affected version, including github.com/cri-o/cri-o. It affects 1 product.

Products include Kubernetes Cri-O.

How do I fix CVE-2022-2995?

Upgrade github.com/cri-o/cri-o to 1.25.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-2995 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2995 exists.

Other vulnerabilities in cri-o

• CVE-2022-0811 Code Injection in CRI-O High 8.8
• CVE-2018-1000400 Privilege escalation in n/a High 8.8
• CVE-2024-5154 Cri-o: malicious container can create symlink on host High 8.1
• CVE-2022-3466 Cri-o: security regression of cve-2022-27652 Medium 4.8
• CVE-2022-0532 Incorrect Permission Assignment for Critical Resource in CRI-O Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-39882, GHSA-phjr-8j92-w5v7, GO-2022-1014, OESA-2024-1251, RHSA-2023:3216.