Skip to content
Fencer Vulns
medium 6.4

CVE-2025-57848 json

Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

published 2025-10-23 12 mo ago modified 2026-10-30 9 d ago also EUVD-2025-35712

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Patch / fix

  • Red Hat RHEL-8-CNV-4.12 v4.12.21-3, v4.12.21-4, v4.12.21-5, v4.12.21-8, v4.12.21-9, v4.12.21-21
  • Red Hat RHEL-9-CNV-4.14 v4.14.16-3, v4.14.16-6, v4.14.16-7, v4.14.16-8, v4.14.16-12, v4.14.16-13, v4.14.16-17, v4.14.16-53, v4.14.16.rhel9-46
  • Red Hat RHEL-9-CNV-4.16 v4.16.26-1, v4.16.26-2, v4.16.26-5, v4.16.26.rhel9-5
  • Red Hat RHEL-9-CNV-4.17 v4.17.34-1, v4.17.34-2, v4.17.34-4, v4.17.34-19, v4.17.34-20, v4.17.34.rhel9-16
  • Red Hat RHEL-9-CNV-4.18 v4.18.22-1, v4.18.22-2, v4.18.22-8, v4.18.22.rhel9-8
  • Red Hat RHEL-9-CNV-4.19 v4.19.14-1, v4.19.14-2, v4.19.14-6, v4.19.14-7, v4.19.14.rhel9-6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-57848 updated cvss 6.4

container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

  • Red Hat OpenShift Virtualization 4 container-native-virtualization/hyperconverged-cluster-operator, container-native-virtualization/ocp-virt-validation-checkup-rhel9, container-native-virtualization/hyperconverged-cluster-webhook-rhel8, container-native-virtualization/hyperconverged-cluster-operator-rhel9
    affected: no fix available
  • Red Hat CNV 4.12 for RHEL 8 container-native-virtualization/virt-api v4.12.21-8, container-native-virtualization/virtio-win v4.12.21-4, container-native-virtualization/kubemacpool v4.12.21-4, container-native-virtualization/virt-handler v4.12.21-8, container-native-virtualization/bridge-marker v4.12.21-4, container-native-virtualization/virt-launcher v4.12.21-8, +37 more
    fixed: vendor fix RHEA-2025:22750
  • Red Hat CNV 4.14 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.14.16-13, container-native-virtualization/pr-helper-rhel9 v4.14.16-12, container-native-virtualization/virtio-win-rhel9 v4.14.16-6, container-native-virtualization/kubemacpool-rhel9 v4.14.16-7, container-native-virtualization/mtq-operator-rhel9 v4.14.16-6, container-native-virtualization/bridge-marker-rhel9 v4.14.16-6, +38 more
    fixed: vendor fix RHEA-2026:0511
  • Red Hat CNV 4.16 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.16.26-1, container-native-virtualization/pr-helper-rhel9 v4.16.26-1, container-native-virtualization/aaq-server-rhel9 v4.16.26-1, container-native-virtualization/virtio-win-rhel9 v4.16.26-1, container-native-virtualization/wasp-agent-rhel9 v4.16.26-1, container-native-virtualization/kubemacpool-rhel9 v4.16.26-1, +48 more
    fixed: vendor fix RHEA-2025:20007
  • Red Hat CNV 4.17 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.17.34-1, container-native-virtualization/pr-helper-rhel9 v4.17.34-2, container-native-virtualization/aaq-server-rhel9 v4.17.34-1, container-native-virtualization/virtio-win-rhel9 v4.17.34-1, container-native-virtualization/wasp-agent-rhel9 v4.17.34-1, container-native-virtualization/kubemacpool-rhel9 v4.17.34-1, +46 more
    fixed: vendor fix RHEA-2025:21677
  • Red Hat CNV 4.18 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.18.22-1, container-native-virtualization/pr-helper-rhel9 v4.18.22-1, container-native-virtualization/aaq-server-rhel9 v4.18.22-1, container-native-virtualization/virtio-win-rhel9 v4.18.22-1, container-native-virtualization/wasp-agent-rhel9 v4.18.22-1, container-native-virtualization/kubemacpool-rhel9 v4.18.22-1, +47 more
    fixed: vendor fix RHEA-2025:21119
  • Red Hat CNV 4.19 for RHEL 9 container-native-virtualization/virt-api-rhel9 v4.19.14-2, container-native-virtualization/pr-helper-rhel9 v4.19.14-2, container-native-virtualization/aaq-server-rhel9 v4.19.14-1, container-native-virtualization/virtio-win-rhel9 v4.19.14-1, container-native-virtualization/wasp-agent-rhel9 v4.19.14-1, container-native-virtualization/kubemacpool-rhel9 v4.19.14-1, +48 more
    fixed: vendor fix RHEA-2025:19904

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
12 mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat RHEL-8-CNV-4.12
  • Red Hat RHEL-9-CNV-4.14
  • Red Hat RHEL-9-CNV-4.16
  • Red Hat RHEL-9-CNV-4.17
  • Red Hat RHEL-9-CNV-4.18
  • Red Hat RHEL-9-CNV-4.19
  • Red Hat Red Hat OpenShift Virtualization 4

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.