Executive brief
Red Hat's Container-native Virtualization images have a flaw where the /etc/passwd file is created with overly permissive group-write permissions during container builds. A non-root user who is a member of the root group can exploit this to modify /etc/passwd, add arbitrary user accounts with UID 0 (root), and gain full administrative control of the container. This allows privilege escalation attacks from inside affected containers, potentially compromising containerized applications and their data.
Technical details
This is a privilege escalation vulnerability (CWE-276: Incorrect Default Permissions) stemming from /etc/passwd being created with group-writable permissions (e.g., 0664 instead of 0644) during container image build time. The vulnerability requires the attacker to already have code execution within the container as a non-root user who is a member of the root group. An attacker exploiting this can modify /etc/passwd to add a new user entry with UID 0, achieving root-level privileges within the container namespace. No network access or authentication bypass is required—only local container execution rights. A patch should involve correcting the file permissions in the container build process to remove group-write permissions.
Affected products
- Red Hat Container-native Virtualization
Timeline
- 2025-10-23: disclosed: CVE-2025-57848 published