6.4
Moyenne
CVE-2025-57848 A container privilege escalation flaw was found in certain Container-native Virtualization images
Description
A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Virtualization 4 | Versions non publiées | |
| RHEL-8-CNV-4.12 4.12 | premières → < 4.12.21-4 | 4.12.21-4 |
| RHEL-9-CNV-4.14 4.14 | premières → < 4.14.16-6 | 4.14.16-6 |
| RHEL-9-CNV-4.17 4.17 | premières → < 4.17.34-1 | 4.17.34-1 |
| RHEL-9-CNV-4.18 4.18 | premières → < 4.18.22-1 | 4.18.22-1 |
| RHEL-9-CNV-4.19 4.19 | premières → < 4.19.14-1 | 4.19.14-1 |
| RHEL-9-CNV-4.16 4.16 | premières → < 4.16.26-1 | 4.16.26-1 |
Références
- RHEA-2025:19904 access.redhat.com
- RHEA-2025:20007 access.redhat.com
- RHEA-2025:21119 access.redhat.com
- RHEA-2025:21677 access.redhat.com
- RHEA-2025:22750 access.redhat.com
- RHEA-2026:0511 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2391099 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift Virtualization 4
Les 96 CVE de Red Hat OpenShift Virtualization 4 →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
Élevée
CVE-2026-102623
A flaw was found in KubeVirt
6.5
Moyenne
CVE-2026-79699
A flaw was found in the containers/storage library
4.4
Moyenne