-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from incorrect group initialization where the container's primary GID wasn't added to supplementary groups. The fix in commit 5c7f283/d82a416 shows modifications to pkg/specgen/namespaces.go where the primary GID is explicitly added to the additional groups array. This aligns with the CWE-842 (Incorrect Group Assignment) description. The libpod/container_internal_linux.go changes indicate the primary GID handling was flawed in user namespace configuration. These functions directly control group membership initialization, and their failure to duplicate the primary GID in supplementary groups matches the vulnerability's technical description of allowing privilege escalation through group dropping.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containers/podman/v4 | go | < 4.2.0 | 4.2.0 |
| github.com/containers/podman/v3 | go | < 3.0.1 | 3.0.1 |
Ongoing coverage of React2Shell