CVE-2022-1227
Published: 29 April 2022
Summary
CVE-2022-1227 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A privilege escalation vulnerability affects Podman, a container management tool. The flaw, tracked as CVE-2022-1227, stems from improper handling of container images and can be triggered when a user executes the "podman top" command against a specially crafted image. It is assigned a CVSS 3.1 score of 8.8 and is associated with weaknesses in access control and privilege management.
An attacker can publish a malicious image to a public registry. Once a victim downloads and interacts with the image by running "podman top," the vulnerability grants the attacker access to the host filesystem, enabling information disclosure or denial of service. Exploitation requires no authentication from the attacker and only user interaction from the victim.
Public advisories from Red Hat, Fedora, and NetApp reference the issue through bug trackers and mailing lists, pointing to updated Podman packages as the primary remediation path. The current EPSS score of 0.33 with a peak of 0.34 indicates sustained moderate exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1644
Vulnerability details
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the…
more
'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires explicit review and modification of privileges when personnel change roles, directly preventing improper ongoing privilege management.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.