Skip to main content

EUVDEUVD-2025-16945

| CVE-2025-5791 HIGH
Incorrect Privilege Assignment (CWE-266)
2025-06-06 secalert@redhat.com GHSA-m65q-v92h-cm7q
Privilege Escalation
7.1
CVSS 3.1 · Vendor: redhat
View

Vulnerability Assessment

Weakness
CWE
CWE-266
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
Impact

The CVSS 7.1 score reflects a local-only attack vector (AV:L) requiring low privileges (PR:L) with high impact on confidentiality and integrity (C:H/I:H). The real-world risk is moderate-to-high: (1) CVSS vector shows this is NOT a network-exploitable issue, limiting blast radius; (2) The vulnerability requires existing local user access and active exploitation of a specific condition (fewer than 1024 groups); (3) However, this condition is common in typical systems where users rarely exceed 1024 group memberships; (4) The impact is severe—unauthorized access to root-owned resources—making this a critical priority for affected systems despite the local-only attack surface. Without KEV, POC, or EPSS data in the provided intelligence, reliance falls to CVSS and CWE context; however, the specificity of the flaw and its deterministic triggering condition suggests exploitability is probable. This is a legitimate priority for patching, particularly in multi-tenant or shared computing environments.
Exploit ScenarioDerived

A system administrator deploys a Rust-based container security scanner compiled against the vulnerable 'users' crate. An unprivileged container user (UID 1001) with membership in 5 groups (fewer than 1024) triggers a scan operation. The vulnerable group enumeration function incorrectly includes group 0 (root) in the returned group list, even though the user is not a member. The scanner's subsequent permission checks grant the container user access to files and directories owned by root:root (e.g., /etc/shadow, system binaries), allowing the attacker to read sensitive configuration or modify system files. The attacker escalates privileges by modifying or reading root-owned files that should be inaccessible. Attack complexity is low (AC:L) as the flaw triggers automatically under the boundary condition; no user interaction (UI:N) or specialized tooling is required—normal application usage triggers the vulnerability.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Privilege escalation vulnerability in the Rust 'users' crate that incorrectly includes the root group in access control lists when a user or process has fewer than 1024 groups. An authenticated local attacker with low privileges can exploit this flaw to gain unauthorized access to resources restricted to the root group, achieving privilege escalation. The vulnerability requires local access and existing user privileges but has high impact on confidentiality and integrity.

RemediationAI

Remediation steps: (1) Identify all Rust projects and binaries with the 'users' crate as a dependency using 'cargo tree' or dependency auditing tools; (2) Update the 'users' crate to the patched version (release version number not provided in submission—consult the official Rust users crate repository on crates.io and GitHub for the fix); (3) Rebuild and redeploy affected Rust binaries; (4) For interim mitigation, restrict local user access on systems where feasible, implement AppArmor/SELinux policies to prevent unprivileged users from executing Rust binaries relying on users crate, or isolate service accounts to single-group membership; (5) Monitor audit logs (ausearch, journalctl) for unexpected privilege escalations or root group access by non-root users.

Affected VersionsENISA

Red Hat OpenShift sandboxed containers 1.1 patch: sha256:a6f29da891174e57fcfd131da7aa90c50459ba24164111b83120a1b91f2eabba

Affected Packages

cargo users no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the Rust 'users' crate, a library used for Unix/Linux user and group enumeration. The flaw stems from CWE-266 (Incorrect Privilege Assignment), specifically in the group listing logic. The vulnerability manifests when the crate's functions enumerate user groups and encounter a boundary condition: systems using getgroups() or similar APIs may incorrectly process group membership when the actual group count is below 1024 groups. This causes erroneous inclusion of group ID 0 (root) in the returned group list, even when the user is not actually a member of that group. The underlying issue likely involves buffer allocation logic, group enumeration loop termination, or group ID filtering that fails to properly validate group membership before inclusion in the access list.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Ubuntu MEDIUM
SUSE HIGH
Red Hat 7.1 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Apr 06, 2026 - 20:30 nvd
Patch available
CVE Published
Jun 06, 2025 - 14:15 nvd
HIGH 7.1

DescriptionCVE.org

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.

Executive ViewAI

Why It Matters

CVE-2025-5791 is a privilege escalation vulnerability in Rust's user crate that could allow attackers to gain unauthorized root-level access on affected systems. This poses a significant risk to any organization running Rust applications that rely on group-based access controls, potentially compromising system security and data integrity.

Business Impact: High
Compensating Controls

Implement strict group membership policies limiting users to fewer than 1024 groups; enforce principle of least privilege at the OS level; enable comprehensive audit logging and alerting for privilege escalation attempts; conduct code review of Rust applications to identify where group validation occurs; consider disabling group-based access control features if operationally feasible; isolate affected systems on segmented networks with restricted administrative access.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2022-20759 HIGH POC
8.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

Ubuntu

Priority: Medium
rust-users
Release Status Version
focal needs-triage -
jammy needs-triage -
noble needs-triage -
upstream needs-triage -
oracular ignored end of life, was needs-triage
questing DNE -
plucky ignored end of life, was needs-triage

SUSE

Severity: High
Product Status
Image SLES15-SP3-Micro-5-2-BYOS-Azure Affected
Image SLES15-SP4-Micro-5-3-BYOS Image SLES15-SP4-Micro-5-3-BYOS-Azure Image SLES15-SP4-Micro-5-4-BYOS Image SLES15-SP4-Micro-5-4-BYOS-Azure Affected
Image SLES15-SP4-Micro-5-3 Image SLES15-SP4-Micro-5-3-BYOS-EC2 Image SLES15-SP4-Micro-5-3-BYOS-GCE Image SLES15-SP4-Micro-5-3-EC2 Image SLES15-SP4-Micro-5-4 Image SLES15-SP4-Micro-5-4-BYOS-EC2 Image SLES15-SP4-Micro-5-4-BYOS-GCE Image SLES15-SP4-Micro-5-4-EC2 Image SLES15-SP4-Micro-5-4-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed

References

Advisories & patches
ADVISORY https://github.com/ogham/rust-users ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-5791 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02166/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3783/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3784/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3785/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3786/ REF https://access.redhat.com/errata/RHSA-2025:12359 REF https://access.redhat.com/security/cve/CVE-2025-5791 REF https://bugzilla.redhat.com/show_bug.cgi?id=2370001 REF https://crates.io/crates/users REF https://github.com/ogham/rust-users/issues/44 REF https://rustsec.org/advisories/RUSTSEC-2025-0040.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy