Skip to content
fr Sign in
6.4 Medium

CVE-2025-57848 A container privilege escalation flaw was found in certain Container-native Virtualization images

Description

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift Virtualization 4 Versions not published
RHEL-8-CNV-4.12 4.12 earliest → < 4.12.21-4 4.12.21-4
RHEL-9-CNV-4.14 4.14 earliest → < 4.14.16-6 4.14.16-6
RHEL-9-CNV-4.17 4.17 earliest → < 4.17.34-1 4.17.34-1
RHEL-9-CNV-4.18 4.18 earliest → < 4.18.22-1 4.18.22-1
RHEL-9-CNV-4.19 4.19 earliest → < 4.19.14-1 4.19.14-1
RHEL-9-CNV-4.16 4.16 earliest → < 4.16.26-1 4.16.26-1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift Virtualization 4

The 96 CVEs of Red Hat OpenShift Virtualization 4 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-102623 A flaw was found in KubeVirt 6.5 Medium CVE-2026-79699 A flaw was found in the containers/storage library 4.4 Medium
Track this CVE