CVE-2022-29526
golang: syscall: faccessat checks wrong group
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
Go versiones anteriores a 1.17.10 y 1.18.x anteriores a 1.18.2, presenta una Asignación Incorrecta de Privilegios. Cuando es llamada con un parámetro flags distinto de cero, la función Faccessat podría informar incorrectamente de que un archivo es accesible
A flaw was found in the syscall.Faccessat function when calling a process by checking the group. This flaw allows an attacker to check the process group permissions rather than a member of the file's group, affecting system availability.
Red Hat Advanced Cluster Management for Kubernetes 2.3.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which resolve security issues and fix several bugs. Issues addressed include a traversal vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-04-20 CVE Reserved
- 2022-06-22 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
- CWE-280: Improper Handling of Insufficient Permissions or Privileges
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| https://groups.google.com/g/golang-announce | Issue Tracking | |
| https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU | Mailing List | |
| https://security.netapp.com/advisory/ntap-20220729-0001 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/golang/go/issues/52313 | 2024-08-03 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | < 1.17.10 Search vendor "Golang" for product "Go" and version " < 1.17.10" | - |
Affected
| in | Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | - | - |
Safe
|
| Golang Search vendor "Golang" | Go Search vendor "Golang" for product "Go" | >= 1.18.0 < 1.18.2 Search vendor "Golang" for product "Go" and version " >= 1.18.0 < 1.18.2" | - |
Affected
| in | Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | - | - |
Safe
|
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Beegfs Csi Driver Search vendor "Netapp" for product "Beegfs Csi Driver" | - | - |
Affected
| ||||||