Vulnerability · Published Apr 29, 2022 · Assigned by redhat
CVE-2022-1227
High 8.8
In plain English
A high-severity security flaw in psgo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)4.2%top 9.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.0.1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | buildah | 1:1.24.2-4.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | buildah | 1.19.9-3.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | buildah-tests | 1.19.9-3.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | buildah-tests | 1:1.24.2-4.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | cockpit-podman | 43-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | cockpit-podman | 29-2.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | conmon | 2:2.1.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | conmon | 2:2.0.26-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | container-selinux | 2:2.179.1-1.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | container-selinux | 2:2.178.0-2.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | containernetworking-plugins | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.0.1-2.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | containers-common | 2:1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | containers-common | 1:1.2.4-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | crun | 0.18-3.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | crun | 1.4.4-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | fuse-overlayfs | 1.4.0-2.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | fuse-overlayfs | 1.8.2-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | libslirp | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | libslirp-devel | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | netavark | 2:1.0.1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.3-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.0-3.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | podman | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman | 3.0.1-9.module_el8.6.0+2886+bfcd65b6 | ALSA-2022:2143 |
| AlmaLinux:8 | podman-catatonit | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-catatonit | 3.0.1-9.module_el8.6.0+2886+bfcd65b6 | ALSA-2022:2143 |
| AlmaLinux:8 | podman-docker | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-docker | 3.0.1-9.module_el8.6.0+2886+bfcd65b6 | ALSA-2022:2143 |
| AlmaLinux:8 | podman-gvproxy | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-plugins | 3.0.1-9.module_el8.6.0+2886+bfcd65b6 | ALSA-2022:2143 |
| AlmaLinux:8 | podman-plugins | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-remote | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-remote | 3.0.1-9.module_el8.6.0+2886+bfcd65b6 | ALSA-2022:2143 |
| AlmaLinux:8 | podman-tests | 3.0.1-9.module_el8.6.0+2886+bfcd65b6 | ALSA-2022:2143 |
| AlmaLinux:8 | podman-tests | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | python3-podman | 4.0.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | runc | 1:1.0.3-2.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | runc | 1.0.0-73.rc95.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | skopeo | 1:1.2.4-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | skopeo | 2:1.6.1-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | skopeo-tests | 1:1.2.4-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | skopeo-tests | 2:1.6.1-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | slirp4netns | 1.1.8-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | slirp4netns | 1.1.8-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | toolbox | 0.0.99.3-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | toolbox | 0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.3-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| AlmaLinux:8 | udica | 0.2.6-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | udica | 0.2.4-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:2143 |
| Debian:12 | golang-github-containers-psgo | 1.7.1+ds1-1 | DEBIAN-CVE-2022-1227 |
| Debian:13 | golang-github-containers-psgo | 1.7.1+ds1-1 | DEBIAN-CVE-2022-1227 |
| Debian:14 | golang-github-containers-psgo | 1.7.1+ds1-1 | DEBIAN-CVE-2022-1227 |
| Debian:12 | libpod | 3.4.7+ds1-1 | DEBIAN-CVE-2022-1227 |
| Go | github.com/containers/podman/v3 | 3.4 | GHSA-66vw-v2x9-hw75 |
| Go | github.com/containers/psgo | 1.7.2 | GO-2022-0558 |
| Go | github.com/containers/psgo | 1.7.2 | GHSA-66vw-v2x9-hw75 |
| Rocky Linux:8 | buildah | 0:1.19.9-3.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | buildah | 1:1.24.2-4.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.4.0+556+40122d08 | RLSA-2022:2143 |
| Rocky Linux:8 | cockpit-podman | 0:43-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | conmon | 2:2.0.26-1.module+el8.4.0+558+7340b765 | RLSA-2022:2143 |
| Rocky Linux:8 | conmon | 2:2.1.0-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | conmon | 2:2.0.26-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | conmon | 2:2.0.26-1.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | container-selinux | 2:2.178.0-2.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | container-selinux | 2:2.179.1-1.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | containernetworking-plugins | 1:1.0.1-2.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.4.0+556+40122d08 | RLSA-2022:2143 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | containers-common | 2:1-27.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.6.0+1054+50b00ff4 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.4.0+556+40122d08 | RLSA-2022:2143 |
| Rocky Linux:8 | crun | 0:0.18-3.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | crun | 0:1.4.4-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | crun | 0:0.18-3.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.4.0+558+7340b765 | RLSA-2022:2143 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.8.2-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.6.0+1054+50b00ff4 | RLSA-2022:1762 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.4.0+556+40122d08 | RLSA-2022:2143 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.3-3.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.3-3.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.0-3.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.0-3.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.0-3.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | podman | 0:3.0.1-9.module+el8.6.0+973+7a06b91e | RLSA-2022:2143 |
| Rocky Linux:8 | podman | 2:4.0.2-6.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | python-podman | 0:4.0.0-1.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | python-podman | 0:4.0.0-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | runc | 0:1.0.0-73.rc95.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | runc | 1:1.0.3-2.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | runc | 0:1.0.0-73.rc95.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | runc | 0:1.0.0-73.rc95.module+el8.5.0+769+55ca48e8 | RLSA-2022:2143 |
| Rocky Linux:8 | skopeo | 1:1.2.4-1.module+el8.5.0+734+8397cf81 | RLSA-2022:2143 |
| Rocky Linux:8 | skopeo | 1:1.2.4-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | skopeo | 2:1.6.1-2.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-2.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.4.0+537+38cf4e42 | RLSA-2022:2143 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-2.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-1.module+el8.5.0+734+8397cf81 | RLSA-2022:2143 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-0.4.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-0.4.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.4.0+556+40122d08 | RLSA-2022:2143 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.6.0+783+10209741 | RLSA-2022:2143 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.5.0+709+440d5e7e | RLSA-2022:2143 |
| Rocky Linux:8 | udica | 0:0.2.6-2.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:2143 |
| Ubuntu:22.04:LTS | golang-github-containers-psgo | no fix listed | UBUNTU-CVE-2022-1227 |
| Ubuntu:24.04:LTS | golang-github-containers-psgo | no fix listed | UBUNTU-CVE-2022-1227 |
| Ubuntu:25.10 | golang-github-containers-psgo | no fix listed | UBUNTU-CVE-2022-1227 |
| Ubuntu:26.04:LTS | golang-github-containers-psgo | no fix listed | UBUNTU-CVE-2022-1227 |
| Ubuntu:26.10 | golang-github-containers-psgo | no fix listed | UBUNTU-CVE-2022-1227 |
Affected products (as reported)
Weakness: CWE-281