CVE-2022-2995: kubernetes cri-o Improper Access Control
Vulnerability summary
CVE-2022-2995 is a high (CVSS 7.1) Improper Access Control vulnerability in kubernetes cri-o. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 19-09-2022PublishedVulnerability first disclosed.
- 29-05-2025Last modifiedVulnerability information updated.
Description
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · Red hatEcosystem advisory · calculated3.6LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · GoEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.39% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (benthamsgaze.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat3 products
- cri-o< 0:1.23.5-11.rhaos4.10.gitfc32aac.el7 | < 0:1.23.5-11.rhaos4.10.gitfc32aac.el8
- cri-o-debuginfo< 0:1.23.5-11.rhaos4.10.gitfc32aac.el7 | < 0:1.23.5-11.rhaos4.10.gitfc32aac.el8
- cri-o-debugsource< 0:1.23.5-11.rhaos4.10.gitfc32aac.el8
Github.com/cri-o1 product
- cri-o< 1.25.0
Kubernetes1 product
- cri-o1.25.0
3 vendors · 5 products
References
14 links- www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/X Refsource MISCARTICLEExploitThird Party Advisory
