CVE-2025-57848

Summary

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Affected Software

VendorProductVersion RangeStatus
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-3 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-21 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-5 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-5 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-5 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-9 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-9 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-8 < *unaffected
Red HatRHEL-8-CNV-4.12v4.12.21-4 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-8 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-3 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16.rhel9-46 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-8 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-8 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-7 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-53 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-8 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-17 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-12 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-13 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.14v4.14.16-6 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34.rhel9-16 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-2 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-2 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-20 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-2 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-19 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-4 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-2 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.17v4.17.34-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22.rhel9-8 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-8 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-2 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-2 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-8 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-2 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-2 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.18v4.18.22-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14.rhel9-6 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-7 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-6 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-2 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected
Red HatRHEL-9-CNV-4.19v4.19.14-1 < *unaffected

Weaknesses

  • CWE-276: Incorrect Default Permissions

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References