REDHAT-BUG-2121453
First published: Thu Aug 25 2022(Updated: )
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Reference: <a href="https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/">https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Buildah |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
- https://github.com/containers/buildah/pull/4200
- https://access.redhat.com/errata/RHSA-2022:7457
- https://access.redhat.com/errata/RHSA-2022:7822
- https://access.redhat.com/errata/RHSA-2022:8008
- https://access.redhat.com/errata/RHSA-2022:8431
- https://access.redhat.com/security/cve/cve-2022-2990
- https://access.redhat.com/errata/RHSA-2023:1325
- https://bugzilla.redhat.com/show_bug.cgi?id=2121453
Frequently Asked Questions
What is the severity of REDHAT-BUG-2121453?
The severity of REDHAT-BUG-2121453 is considered to be significant due to potential sensitive information disclosure and data modification risks.
How do I fix REDHAT-BUG-2121453?
To fix REDHAT-BUG-2121453, you should update to the latest version of Buildah that includes the patched versions addressing this vulnerability.
Who is affected by REDHAT-BUG-2121453?
Users of the Buildah container engine who utilize supplementary groups to set access permissions are affected by REDHAT-BUG-2121453.
What causes the vulnerability in REDHAT-BUG-2121453?
The vulnerability in REDHAT-BUG-2121453 is caused by incorrect handling of supplementary groups within the Buildah container engine.
Is direct access required to exploit REDHAT-BUG-2121453?
Yes, an attacker needs direct access to the affected container where supplementary groups are being used to exploit REDHAT-BUG-2121453.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2990
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/buildah