Bug 870931 – <app-containers/podman-4.3.0: incorrect handling of supplementary groups

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-09-17 17:59:19 UTC]

CVE-2022-2989:

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

The RedHat bug has no reference to upstream: https://bugzilla.redhat.com/show_bug.cgi?id=2121445

[Comment 1 John Helmert III 2022-09-19 20:07:43 UTC]

(In reply to John Helmert III from comment #0)
> CVE-2022-2989:
> 
> An incorrect handling of the supplementary groups in the Podman container
> engine might lead to the sensitive information disclosure or possible data
> modification if an attacker has direct access to the affected container
> where supplementary groups are used to set access permissions and is able to
> execute a binary code in that container.
> 
> The RedHat bug has no reference to upstream:
> https://bugzilla.redhat.com/show_bug.cgi?id=2121445

Now there is! Unreleased patch is: https://github.com/containers/podman/commit/5c7f28336171f0a5137edd274e45608120d31289

[Comment 2 John Helmert III 2022-09-26 20:44:22 UTC]

(In reply to John Helmert III from comment #1)
> (In reply to John Helmert III from comment #0)
> > CVE-2022-2989:
> > 
> > An incorrect handling of the supplementary groups in the Podman container
> > engine might lead to the sensitive information disclosure or possible data
> > modification if an attacker has direct access to the affected container
> > where supplementary groups are used to set access permissions and is able to
> > execute a binary code in that container.
> > 
> > The RedHat bug has no reference to upstream:
> > https://bugzilla.redhat.com/show_bug.cgi?id=2121445
> 
> Now there is! Unreleased patch is:
> https://github.com/containers/podman/commit/
> 5c7f28336171f0a5137edd274e45608120d31289

In v4.3.0-rc1

[Comment 3 John Helmert III 2022-10-19 13:21:40 UTC]

And now in 4.3.0. Please bump.

[Comment 4 Larry the Git Cow 2022-10-20 00:03:29 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6e114cc38eb7cb4d434e366d6fff10281b483827

commit 6e114cc38eb7cb4d434e366d6fff10281b483827
Author:     Zac Medico <[e-mail]>
AuthorDate: 2022-10-20 00:02:49 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2022-10-20 00:02:57 +0000

    app-containers/podman: add 4.3.0
    
    Bug: https://bugs.gentoo.org/870931
    Signed-off-by: Zac Medico <[e-mail]>

 app-containers/podman/Manifest            |   1 +
 app-containers/podman/podman-4.3.0.ebuild | 165 ++++++++++++++++++++++++++++++
 2 files changed, 166 insertions(+)

[Comment 5 John Helmert III 2022-10-20 01:14:53 UTC]

Thank you! Please stabilize when ready.

[Comment 6 Larry the Git Cow 2023-01-06 22:34:08 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4ed032cdd4aff2e5e517f0f380d2587fc53e81a

commit c4ed032cdd4aff2e5e517f0f380d2587fc53e81a
Author:     Zac Medico <[e-mail]>
AuthorDate: 2023-01-06 22:33:27 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2023-01-06 22:33:46 +0000

    app-containers/podman: drop 4.1.0-r1, 4.2.1, 4.3.0
    
    Bug: https://bugs.gentoo.org/870931
    Signed-off-by: Zac Medico <[e-mail]>

 app-containers/podman/Manifest               |   3 -
 app-containers/podman/podman-4.1.0-r1.ebuild | 165 ---------------------------
 app-containers/podman/podman-4.2.1.ebuild    | 165 ---------------------------
 app-containers/podman/podman-4.3.0.ebuild    | 165 ---------------------------
 4 files changed, 498 deletions(-)

[Comment 7 John Helmert III 2023-01-08 17:04:54 UTC]

Thanks!

[Comment 8 Larry the Git Cow 2024-07-05 07:06:06 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=3671dbb8919b2952a3de8b9a51e7573f2b16d234

commit 3671dbb8919b2952a3de8b9a51e7573f2b16d234
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-07-05 07:05:25 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-07-05 07:06:00 +0000

    [ GLSA 202407-12 ] podman: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/829896
    Bug: https://bugs.gentoo.org/870931
    Bug: https://bugs.gentoo.org/896372
    Bug: https://bugs.gentoo.org/921290
    Bug: https://bugs.gentoo.org/923751
    Bug: https://bugs.gentoo.org/927500
    Bug: https://bugs.gentoo.org/927501
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202407-12.xml | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)