Skip to content
Fencer Vulns
high 7.1

CVE-2025-5791 json

Users: `root` appended to group listings

published 2025-01-15 21 mo ago modified 2026-11-04 4 d ago also GHSA-m65q-v92h-cm7q , RUSTSEC-2025-0040 , EUVD-2025-16945

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.

Patch / fix

  • Red Hat Red Hat OpenShift sandboxed containers 1.10 1.10-1753885668
  • afterburn Linux Micro 6.1 5.10.0.git73.b97f772-slfo.1.1_1.1
  • afterburn Linux Micro 6.0 5.10.0.git73.b97f772-1.1
  • afterburn Linux Micro 6.0 5.9.0.git21.a73f509-1.1
  • afterburn Linux Micro 6.1 5.9.0.git21.a73f509-slfo.1.1_1.1
  • afterburn SLE Micro 5.4, SLE Micro 5.3 5.9.0.git21.a73f509-150400.3.3.1
  • afterburn SLE Micro 5.5 5.9.0.git21.a73f509-150500.3.3.1
  • afterburn SLE Micro 5.2 5.9.0.git21.a73f509-150300.3.5.1
  • himmelblau SLE Module for Basesystem 15 SP7 0.7.17+git.0.1ebdab0-150700.3.3.2

suse advisories SUSE-SU-2026:23071-1SUSE-SU-2026:22917-1SUSE-RU-2025:21046-1SUSE-RU-2025:20961-1SUSE-SU-2025:3786-1SUSE-SU-2025:3785-1

  • lsd openSUSE Tumbleweed 1.2.0-1.1
  • agama openSUSE Tumbleweed 17+60.68fdb92ec-26.1
  • afterburn openSUSE Tumbleweed 5.8.2-3.1
  • flake-pilot openSUSE Tumbleweed 3.1.19-1.1
  • mirrorsorcerer openSUSE Tumbleweed 0.1.3~1-1.1

opensuse advisories openSUSE-SU-2025:15628-1openSUSE-SU-2025:15412-1openSUSE-SU-2025:15335-1openSUSE-SU-2025:15217-1openSUSE-SU-2025:15246-1

  • kata-containers-cc Azure Linux 3.0 3.15.0.aks0-15
  • kata-containers-cc CBL-Mariner 2.0 3.2.0.azl2-7

azure linux advisories AZL-63771AZL-63848

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-5791 updated cvss 7.1

users: `root` appended to group listings

  • Red Hat Enterprise Linux 9 afterburn, afterburn-dracut Red Hat Enterprise Linux 10 rust-ssh-key-dir Red Hat OpenShift Container Platform 4 afterburn, rust-afterburn, afterburn-dracut
    affected: no fix planned “Will not fix”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: no fix available
  • Red Hat OpenShift sandboxed containers 1.10 openshift-sandboxed-containers 1.10-1753885668
    fixed: vendor fix RHSA-2025:12359
  • Red Hat OpenShift Container Platform 4 kata-containers Red Hat OpenShift sandboxed containers 1.10 openshift-sandboxed-containers 1.10-1752227478, openshift-sandboxed-containers 1.10-1752227514, openshift-sandboxed-containers 1.10-1752228093, openshift-sandboxed-containers 1.10-1752234172, openshift-sandboxed-containers 1.10-1753276739, openshift-sandboxed-containers 1.10-1753277135, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
17 mo ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
crates.io users
>=0.8.0, <=0.11.0
>=0.8.0
 no fix listed

Affected products

  • Red Hat Red Hat OpenShift sandboxed containers 1.10
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Trusted Profile Analyzer

Classification

Weakness
  • CWE-266 Incorrect Privilege Assignment

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.