CVE-2025-57848: Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-23 · updated 2026-10-30
Weakness: CWE-276

Description

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Affected products

Red Hat OpenShift Virtualization 4: all versions
Red Hat RHEL-8-CNV-4.12: all versions — fixed in v4.12.21-4
Red Hat RHEL-9-CNV-4.14: all versions — fixed in v4.14.16-6
Red Hat RHEL-9-CNV-4.16: all versions — fixed in v4.16.26-1
Red Hat RHEL-9-CNV-4.17: all versions — fixed in v4.17.34-1
Red Hat RHEL-9-CNV-4.18: all versions — fixed in v4.18.22-1
Red Hat RHEL-9-CNV-4.19: all versions — fixed in v4.19.14-1

How to fix

Upgrade to a fixed version: Red Hat RHEL-8-CNV-4.12 v4.12.21-4; Red Hat RHEL-9-CNV-4.14 v4.14.16-6; Red Hat RHEL-9-CNV-4.16 v4.16.26-1; Red Hat RHEL-9-CNV-4.17 v4.17.34-1; Red Hat RHEL-9-CNV-4.18 v4.18.22-1; Red Hat RHEL-9-CNV-4.19 v4.19.14-1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-57848 or the next vulnerability affects your stack