x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-2995

[GoVulnBot]

CVE-2022-2995 references github.com/cri-o/cri-o, which may be a Go module.

Description:
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-2995
• JSON: https://github.com/CVEProject/cvelist/tree/4cb63c38b84bc437ae596dea389a21f7bb535bd3/2022/2xxx/CVE-2022-2995.json
• web: https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
• fix: server: add container GID to additional groups cri-o/cri-o#6159
• Imported by: https://pkg.go.dev/github.com/cri-o/cri-o?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/cri-o/cri-o
    packages:
      - package: cri-o
description: |
    Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
cves:
  - CVE-2022-2995
references:
  - web: https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
  - fix: https://github.com/cri-o/cri-o/pull/6159

[gopherbot]

Change https://go.dev/cl/432173 mentions this issue: data/excluded: add GO-2022-1014.yaml for CVE-2022-2995

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607230 mentions this issue: data/reports: unexclude 20 reports (28)