What is the CVSS score of CVE-2025-57848?

CVE-2025-57848 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-57848?

Yes, a patch is available for CVE-2025-57848. Update the affected software to the latest version immediately.

OpenShift Virtualization CVE-2025-57848

MEDIUM

Incorrect Default Permissions (CWE-276)

2025-10-23 secalert@redhat.com

Privilege Escalation Red Hat

6.4

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Local attack vector within container, high complexity requiring GID 0 membership, high privileges confirm PR:H; scope unchanged as host is not directly affected.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 11:36 vuln.today

DescriptionCVE.org

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

AnalysisAI

Privilege escalation to container root in Red Hat Container-native Virtualization (CNV) images allows an attacker with command execution inside an affected container and membership in the root group (GID 0) to gain full UID 0 privileges within that container. The flaw originates during image build time, where /etc/passwd is incorrectly created with group-writable permissions (CWE-276), enabling root-group members to inject arbitrary user entries - including those with UID 0. No public exploit code has been identified at time of analysis, and Red Hat has released remediation via multiple enhancement advisories. Exploitation probability appears low given the high CVSS complexity and privilege requirements.

Technical ContextAI

The vulnerability resides in the container image build process for Red Hat's Container-native Virtualization (CNV) - now marketed as OpenShift Virtualization - which packages KVM-based virtual machine workloads as containers on Kubernetes/OpenShift. CWE-276 (Incorrect Default Permissions) describes the root cause: during image construction, the /etc/passwd file is assigned group-writable permissions rather than the standard 0644 (owner-write only). On Linux systems, the root group (GID 0) is distinct from the root user (UID 0) and is sometimes granted to privileged-but-non-root processes within containers. Any process holding GID 0 membership can write to a group-writable /etc/passwd, allowing arbitrary user definitions - including a crafted entry with UID 0 - to be inserted. This is a container-internal privilege escalation; the CVSS S:U (Unchanged) scope indicates no direct path to host escape is described.

Affected ProductsAI

The vulnerability affects certain Container-native Virtualization (CNV) images distributed by Red Hat as part of OpenShift Virtualization. Specific image versions are addressed by Red Hat Enhancement Advisories RHEA-2025:19904, RHEA-2025:21119, RHEA-2025:21677, RHEA-2025:22750, and RHEA-2026:0511, suggesting a range of affected image releases patched across multiple errata cycles. No CPE strings were provided in the intelligence data, so exact affected version ranges are not independently confirmed beyond the Red Hat errata scope. The Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2025-57848 and Bugzilla issue 2391099 are the authoritative sources for affected package enumeration.

RemediationAI

Update affected Container-native Virtualization images by applying the Red Hat erratas listed in the advisories: RHEA-2025:19904, RHEA-2025:21119, RHEA-2025:21677, RHEA-2025:22750, and RHEA-2026:0511, available via the Red Hat Customer Portal at https://access.redhat.com/errata/. Exact fixed image versions should be confirmed against the specific errata applicable to your OpenShift/CNV release stream. As a compensating control prior to patching, restrict which container workloads or service accounts are permitted root group (GID 0) membership, since exploitation depends on that group assignment; removing or auditing GID 0 grants in container security contexts breaks the attack chain without requiring an immediate image update. Additionally, enabling read-only filesystem enforcement on pod security contexts (readOnlyRootFilesystem: true) would prevent writes to /etc/passwd at runtime, though this may require application compatibility testing. Monitor for unauthorized entries in /etc/passwd within CNV containers as a detection measure.