CVE-2022-2989: Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification

The vulnerability stems from incorrect group initialization where the container's primary GID wasn't added to supplementary groups. The fix in commit 5c7f283/d82a416 shows modifications to pkg/specgen/namespaces.go where the primary GID is explicitly added to the additional groups array. This aligns with the CWE-842 (Incorrect Group Assignment) description. The libpod/container_internal_linux.go changes indicate the primary GID handling was flawed in user namespace configuration. These functions directly control group membership initialization, and their failure to duplicate the primary GID in supplementary groups matches the vulnerability's technical description of allowing privilege escalation through group dropping.