EUVD-2025-209304Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
AnalysisAI
Privilege escalation in OpenShift Update Service (OSUS) container images allows local attackers with high privileges to gain root access by modifying the group-writable /etc/passwd file created during build time. An attacker executing commands within an affected container can leverage root group membership to inject a new user with UID 0, achieving full container root privileges. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
This vulnerability exploits improper file permission configuration at container build time, rooted in CWE-276 (Incorrect Default Permissions). The /etc/passwd file, typically a critical system authentication database, was created with group-writable permissions during the OSUS image build process. In Linux containers, membership in the root group (GID 0) combined with group-write access to /etc/passwd enables arbitrary modification of user records without requiring root UID ownership. An attacker can append a new entry with UID 0 to escalate from their current privilege level to full root access, effectively breaking container isolation boundaries. The vulnerability affects Red Hat OpenShift Update Service (cpe:2.3:a:red_hat:red_hat_openshift_update_service:*:*:*:*:*:*:*:*) across affected versions.
RemediationAI
Apply the vendor-released patch from Red Hat for OpenShift Update Service; consult https://access.redhat.com/security/cve/CVE-2025-57854 for the specific patched version applicable to your deployment. The primary fix involves rebuilding affected OSUS container images with proper /etc/passwd file permissions (non-group-writable, typically 0644 or 0444). As an immediate workaround in container deployments, restrict group membership and ensure containers run with minimal privilege levels (non-root user, dropped capabilities) and enforce read-only root filesystems where feasible. Verify that container build processes enforce restrictive default file permissions and implement image scanning to detect group-writable critical system files in existing images.
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
JWT claim validation failures in Red Hat Quay's federated robot account and SSO authentication pathways allow an attacke
Red Hat Quay's notification API exposes sensitive integration secrets - including webhook URLs, Slack tokens, and email
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today