-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cri-o/cri-o | go | < 1.25.0 | 1.25.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from incorrect supplementary group handling in CRI-O's container initialization. The patch shows critical changes in setupContainerUser where: 1) GID assignment was moved after RunAsGroup check, and 2) AddProcessAdditionalGid(gid) was added. This indicates the original code didn't include the primary GID in supplementary groups when RunAsGroup was used, violating Linux's expectation that the primary group is duplicated in supplementary groups. The CWE-284/732 mapping and added test case validating supplementary groups confirm this was the vulnerable flow.
GoGoOngoing coverage of React2Shell