CVE-2022-1227

Aliases:GHSA-66vw-v2x9-hw75GO-2022-0558
Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 29 Apr 2022, 15:45
Last modified:02 Aug 2024, 23:55

Vulnerability Summary

Overall Risk (default)
high
52/100
CVSS Score
8.8 HIGH
v3.1 (nvd)
EPSS Score
33.27% HIGH
33% probability +1.21%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

29 Apr 2022, 15:45
Published
Vulnerability first disclosed
02 Aug 2024, 23:55
Last Modified
Vulnerability information updated

Description

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 33.27%• Percentile: 97%

Techniques & Countermeasures

  • CWE-269•Improper Privilege Management

    The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

  • CWE-281•Improper Preservation of Permissions

    The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Systems

  • fedoraproject•fedora

    34 | 35

  • github.com/containers•psgo

    < 1.7.2

  • github.com/containers/podman•v3

    < 3.4

  • podman_project•podman

    < 4.0.0

  • psgo_project•psgo

    < 1.7.2

  • redhat•developer_tools

    1.0

  • redhat•enterprise_linux

    7.0 | 8.0

  • redhat•enterprise_linux_eus

    8.6

  • redhat•enterprise_linux_for_ibm_z_systems

    7.0 | 8.6

  • redhat•enterprise_linux_for_power_little_endian

    7.0 | 8.6

  • redhat•enterprise_linux_server

    7.0

  • redhat•enterprise_linux_server_aus

    8.6

  • redhat•enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions

    8.6

  • redhat•enterprise_linux_server_tus

    8.6

  • redhat•enterprise_linux_server_update_services_for_sap_solutions

    8.6

  • redhat•enterprise_linux_workstation

    7.0

  • redhat•openshift_container_platform

    4.0

  • redhat•quay

    3.0.0

References (13)