CVE-2022-2990

CVE-2022-2990 is a high-severity vulnerability in the Buildah container engine, affecting Buildah, Red Hat Enterprise Linux, and OpenShift Container Platform. It stems from incorrect handling of supplementary groups, potentially leading to sensitive information disclosure or data modification. An attacker requires direct access to an affected container where supplementary groups are used for access control and the ability to execute binary code. While rated with a CVSS score of 7.1, there is currently no public exploit code (Metasploit, Nuclei, ExploitDB) and no evidence of active exploitation or significant community discussion.