Read the docs
TI-2022-02765 Aliases CVE-2022-2995GHSA-phjr-8j92-w5v7

Improper access control in cri-o

Priority HIGH 66CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/cri-o/cri-o (Go): 1.25.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—cri-ocri-o 1.25.0—No fix listedCNA
—github.com/cri-o/cri-o (Go)before 1.25.01.25.0Patch availableGHSA-phjr-8j92-w5v7
  • cri-o Vendor— Affected cri-o 1.25.0 Fixed in — No fix listed CNA
  • github.com/cri-o/cri-o (Go) Vendor— Affected before 1.25.0 Fixed in 1.25.0 Patch available GHSA-phjr-8j92-w5v7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:cri-o:1.25.0:*:*:*:*:*:*:*1.25.0VulnerableKubernetes
  • cpe:2.3:a:kubernetes:cri-o:1.25.0:*:*:*:*:*:*:* Versions 1.25.0 Vulnerable ·Kubernetes

Remediation

  • Fix · GHSA-phjr-8j92-w5v7 github.com/cri-o/cri-o (Go) Fixed in 1.25.0 Advisory →

Red Hat 3 advisories

  • RHSA-2023:3541 Released 2023-06-14 · Red Hat rating Low
    OpenShift Container Platform 4.11.43 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.11 python-flask-1:1.1.2-6.el8, python-flask-doc-1:1.1.2-6.el8, python3-flask-1:1.1.2-6.el8
    • Red Hat OpenShift Container Platform 4.11 cri-o-1.24.5-5.rhaos4.11.git8bf967b.el8
  • RHSA-2023:3216 Released 2023-05-24 · Red Hat rating Low
    OpenShift Container Platform 4.10.60 packages and security update
    • Red Hat OpenShift Container Platform 4.10 cri-o-1.23.5-11.rhaos4.10.gitfc32aac.el7, cri-o-1.23.5-11.rhaos4.10.gitfc32aac.el8
  • RHSA-2022:7398 Released 2023-01-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.0 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
    • Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:3216
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:3541
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2022:7398
Not affected: 5 products
  • Ironic content for Red Hat OpenShift Container Platform 4.11
  • Ironic content for Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2995
  2. 2026-10-03 Alias added: GHSA-phjr-8j92-w5v7

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2022-00719 Code injection in CRI-O CVSS 3.1HIGH 8.8
  • TI-2018-15874 Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error… CVSS 3.0HIGH 8.8
  • TI-2024-04785 Cri-o: malicious container can create symlink on host CVSS 3.1HIGH 8.1
  • TI-2022-01574 Uncontrolled resource consumption in CRI-O CVSS 3.1HIGH 7.5
  • TI-2022-03955 Cri-o: /etc/passwd tampering privesc CVSS 3.1HIGH 7.8
  • TI-2022-10633 Incorrect default permissions in cri-o CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences