CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2070368	Issue Tracking Third Party Advisory
https://github.com/containers/podman/issues/10941	Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
https://security.netapp.com/advisory/ntap-20240628-0001/
https://bugzilla.redhat.com/show_bug.cgi?id=2070368	Issue Tracking Third Party Advisory
https://github.com/containers/podman/issues/10941	Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
https://security.netapp.com/advisory/ntap-20240628-0001/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:podman_project:podman::::::::
	cpe:2.3:a:psgo_project:psgo::::::go::*

Configuration 2 (hide)

OR	cpe:2.3:a:redhat:developer_tools:1.0:::::::*
	cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:::::::*
	cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::*
	cpe:2.3:a:redhat:quay:3.0.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:34:::::::*
	cpe:2.3:o:fedoraproject:fedora:35:::::::*

History

21 Nov 2024, 06:40

Type	Values Removed	Values Added
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2070368 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2070368 - Issue Tracking, Third Party Advisory
References	~~() https://github.com/containers/podman/issues/10941 - Exploit, Issue Tracking, Third Party Advisory~~	() https://github.com/containers/podman/issues/10941 - Exploit, Issue Tracking, Third Party Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ -
References	~~() https://security.netapp.com/advisory/ntap-20240628-0001/ -~~	() https://security.netapp.com/advisory/ntap-20240628-0001/ -

28 Jun 2024, 16:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20240628-0001/ -

23 Jul 2022, 10:04

Type	Values Removed	Values Added
References	~~(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ -~~	(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ - Mailing List, Third Party Advisory
CPE		cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:::::::* cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:::::::* cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.6:::::::* cpe:2.3:a:redhat:developer_tools:1.0:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.6:::::::* cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::* cpe:2.3:o:fedoraproject:fedora:35:::::::* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::* cpe:2.3:o:fedoraproject:fedora:34:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:::::::*

14 May 2022, 03:15

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ -

11 May 2022, 14:52

Type	Values Removed	Values Added
CWE		CWE-269
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.8 v3 : 8.8
References	~~(MISC) https://github.com/containers/podman/issues/10941 -~~	(MISC) https://github.com/containers/podman/issues/10941 - Exploit, Issue Tracking, Third Party Advisory
References	~~(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2070368 -~~	(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2070368 - Issue Tracking, Third Party Advisory
CPE		cpe:2.3:a:psgo_project:psgo::::::go::* cpe:2.3:a:podman_project:podman:::::::: cpe:2.3:o:redhat:enterprise_linux:7.0:::::::* cpe:2.3:a:redhat:openshift_container_platform:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::* cpe:2.3:a:redhat:quay:3.0.0:::::::*

29 Apr 2022, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-04-29 16:15

Updated : 2024-11-21 06:40

NVD link : CVE-2022-1227

Mitre link : CVE-2022-1227

CVE.ORG link : CVE-2022-1227

JSON object : View

Products Affected

redhat

enterprise_linux_server_update_services_for_sap_solutions
enterprise_linux_for_ibm_z_systems
developer_tools
enterprise_linux_server_aus
openshift_container_platform
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
enterprise_linux_workstation
enterprise_linux_server_tus
enterprise_linux_for_power_little_endian
enterprise_linux_eus
enterprise_linux_server
quay
enterprise_linux

fedoraproject

fedora

psgo_project

psgo

podman_project

podman

CWE

CWE-281

Improper Preservation of Permissions

CWE-269

Improper Privilege Management

8.8 /10