CVE & CISA-KEV Catalog

CVE-2022-2995

HIGH

7.1

CVSS v3

Description

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

CWE-284Improper Access Control CWE-732Incorrect Permission Assignment for Critical Resource

How to fix

Remediation Available

cri-oRed Hat / RHEL

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el7RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el7RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

cri-oRocky

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el7RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el7RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

cri-o-debuginfoRocky

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el7RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

cri-o-debuginfoRed Hat / RHEL

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el7RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

cri-o-debugsourceRocky

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

cri-o-debugsourceRed Hat / RHEL

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.23.5-11.rhaos4.10.gitfc32aac.el8RHSA-2023:3216

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

Fixed in:0:1.24.5-5.rhaos4.11.git8bf967b.el8RHSA-2023:3541

jenkinsRocky

Fixed in:0:2.387.3.1684251986-1.el8RHSA-2023:3216

Fixed in:0:2.387.3.1684251986-1.el8RHSA-2023:3216

jenkinsRed Hat / RHEL

Fixed in:0:2.387.3.1684251986-1.el8RHSA-2023:3216

Fixed in:0:2.387.3.1684251986-1.el8RHSA-2023:3216

openshiftRed Hat / RHEL

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

openshiftRocky

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

openshift-hyperkubeRocky

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

openshift-hyperkubeRed Hat / RHEL

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

Fixed in:0:4.11.0-202305261554.p0.g38b1413.assembly.stream.el8RHSA-2023:3541

openshift-kuryrRocky

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryrRed Hat / RHEL

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryr-cniRed Hat / RHEL

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryr-cniRocky

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryr-commonRocky

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryr-commonRed Hat / RHEL

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryr-controllerRed Hat / RHEL

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openshift-kuryr-controllerRocky

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

openstack-ironicRocky

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironicRed Hat / RHEL

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-apiRocky

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-apiRed Hat / RHEL

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-commonRed Hat / RHEL

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-commonRocky

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-conductorRed Hat / RHEL

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-conductorRocky

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-dnsmasq-tftp-serverRed Hat / RHEL

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

openstack-ironic-dnsmasq-tftp-serverRocky

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

python-flaskRocky

Fixed in:1:1.1.2-6.el8RHSA-2023:3541

python-flaskRed Hat / RHEL

Fixed in:1:1.1.2-6.el8RHSA-2023:3541

python-flask-docRed Hat / RHEL

Fixed in:1:1.1.2-6.el8RHSA-2023:3541

python-flask-docRocky

Fixed in:1:1.1.2-6.el8RHSA-2023:3541

python3-flaskRocky

Fixed in:1:1.1.2-6.el8RHSA-2023:3541

python3-flaskRed Hat / RHEL

Fixed in:1:1.1.2-6.el8RHSA-2023:3541

python3-ironic-testsRocky

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

python3-ironic-testsRed Hat / RHEL

Fixed in:1:20.2.1-0.20230605115028.483a7f9.el8RHSA-2023:3541

python3-kuryr-kubernetesRocky

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

python3-kuryr-kubernetesRed Hat / RHEL

Fixed in:0:4.10.0-202305161315.p0.g8e4df8b.assembly.stream.el8RHSA-2023:3216

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploit Intelligence

0.37%probability of exploitation in 30 days

29thpercentile

Low risk: more likely to be exploited than 29% of all known CVEs.

References

Patch1

github.com

Exploit1

benthamsgaze.org

Related Vulnerabilities

Other CWE-284 (Improper Access Control) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2023-27350	Critical	9.8	100%	KEV + Ransom	Fix
CVE-2019-1653	High	7.5	100%	KEV	-
CVE-2023-23752	Medium	5.3	100%	KEV	Fix
CVE-2023-29298	High	7.5	100%	KEV	-
CVE-2023-38205	High	7.5	100%	KEV	-
CVE-2024-27348	Critical	9.8	99%	KEV	Fix

Embed a live status badge for CVE-2022-2995

Markdown

[![CVE-2022-2995](https://tridentstack.com/cve/badge/CVE-2022-2995.svg)](https://tridentstack.com/cve/CVE-2022-2995)

HTML

<a href="https://tridentstack.com/cve/CVE-2022-2995"><img src="https://tridentstack.com/cve/badge/CVE-2022-2995.svg" alt="CVE-2022-2995"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-05-29.