Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions

Summary

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Timeline

1. Oct 23, 2025, 8:10 PM UTCCVE published
2. Oct 25, 2025, 3:56 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 6, 2026, 10:50 AM UTCRecord last updated

Affected versions

• container-native-virtualization/bridge-marker

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator

  Version range not reported

• container-native-virtualization/cnv-containernetworking-plugins

  Version range not reported

• container-native-virtualization/cnv-must-gather-rhel8

  Version range not reported

• container-native-virtualization/hco-bundle-registry

  Version range not reported

• container-native-virtualization/hostpath-csi-driver

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel8

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel8-operator

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel8

  Version range not reported

• container-native-virtualization/kubemacpool

  Version range not reported

• container-native-virtualization/kubevirt-console-plugin

  Version range not reported

• container-native-virtualization/kubevirt-ssp-operator

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-copy-template

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-operator

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status

  Version range not reported

• container-native-virtualization/kubevirt-template-validator

  Version range not reported

• container-native-virtualization/libguestfs-tools

  Version range not reported

• container-native-virtualization/ovs-cni-marker

  Version range not reported

• container-native-virtualization/ovs-cni-plugin

  Version range not reported

• container-native-virtualization/virt-api

  Version range not reported

• container-native-virtualization/virt-artifacts-server

  Version range not reported

• container-native-virtualization/virt-cdi-apiserver

  Version range not reported

• container-native-virtualization/virt-cdi-cloner

  Version range not reported

• container-native-virtualization/virt-cdi-controller

  Version range not reported

• container-native-virtualization/virt-cdi-importer

  Version range not reported

• container-native-virtualization/virt-cdi-operator

  Version range not reported

• container-native-virtualization/virt-cdi-uploadproxy

  Version range not reported

• container-native-virtualization/virt-cdi-uploadserver

  Version range not reported

• container-native-virtualization/virt-controller

  Version range not reported

• container-native-virtualization/virt-exportproxy

  Version range not reported

• container-native-virtualization/virt-exportserver

  Version range not reported

• container-native-virtualization/virt-handler

  Version range not reported

• container-native-virtualization/virtio-win

  Version range not reported

• container-native-virtualization/virt-launcher

  Version range not reported

• container-native-virtualization/virt-operator

  Version range not reported

• container-native-virtualization/vm-network-latency-checkup

  Version range not reported

• container-native-virtualization/bridge-marker-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cnv-containernetworking-plugins-rhel9

  Version range not reported

• container-native-virtualization/cnv-must-gather-rhel9

  Version range not reported

• container-native-virtualization/hco-bundle-registry-rhel9

  Version range not reported

• container-native-virtualization/hostpath-csi-driver-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-operator-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel9

  Version range not reported

• container-native-virtualization/kubemacpool-rhel9

  Version range not reported

• container-native-virtualization/kubesecondarydns-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-apiserver-proxy-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-console-plugin-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-dpdk-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ssp-operator-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-template-validator-rhel9

  Version range not reported

• container-native-virtualization/libguestfs-tools-rhel9

  Version range not reported

• container-native-virtualization/mtq-controller-rhel9

  Version range not reported

• container-native-virtualization/mtq-lock-server-rhel9

  Version range not reported

• container-native-virtualization/mtq-operator-rhel9

  Version range not reported

• container-native-virtualization/multus-dynamic-networks-rhel9

  Version range not reported

• container-native-virtualization/ovs-cni-plugin-rhel9

  Version range not reported

• container-native-virtualization/pr-helper-rhel9

  Version range not reported

• container-native-virtualization/virt-api-rhel9

  Version range not reported

• container-native-virtualization/virt-artifacts-server-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-apiserver-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-cloner-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-importer-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-operator-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadserver-rhel9

  Version range not reported

• container-native-virtualization/virt-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-exportproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-exportserver-rhel9

  Version range not reported

• container-native-virtualization/virt-handler-rhel9

  Version range not reported

• container-native-virtualization/virtio-win-rhel9

  Version range not reported

• container-native-virtualization/virt-launcher-rhel9

  Version range not reported

• container-native-virtualization/virt-operator-rhel9

  Version range not reported

• container-native-virtualization/vm-console-proxy-rhel9

  Version range not reported

• container-native-virtualization/vm-network-latency-checkup-rhel9

  Version range not reported

• container-native-virtualization/aaq-controller-rhel9

  Version range not reported

• container-native-virtualization/aaq-operator-rhel9

  Version range not reported

• container-native-virtualization/aaq-server-rhel9

  Version range not reported

• container-native-virtualization/bridge-marker-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cnv-containernetworking-plugins-rhel9

  Version range not reported

• container-native-virtualization/cnv-must-gather-rhel9

  Version range not reported

• container-native-virtualization/hco-bundle-registry-rhel9

  Version range not reported

• container-native-virtualization/hostpath-csi-driver-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-operator-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel9

  Version range not reported

• container-native-virtualization/kubemacpool-rhel9

  Version range not reported

• container-native-virtualization/kubesecondarydns-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-apiserver-proxy-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-common-instancetypes-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-console-plugin-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-dpdk-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ipam-controller-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-realtime-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ssp-operator-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-storage-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-template-validator-rhel9

  Version range not reported

• container-native-virtualization/libguestfs-tools-rhel9

  Version range not reported

• container-native-virtualization/multus-dynamic-networks-rhel9

  Version range not reported

• container-native-virtualization/ovs-cni-plugin-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-cni-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9

  Version range not reported

• container-native-virtualization/pr-helper-rhel9

  Version range not reported

• container-native-virtualization/sidecar-shim-rhel9

  Version range not reported

• container-native-virtualization/virt-api-rhel9

  Version range not reported

• container-native-virtualization/virt-artifacts-server-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-apiserver-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-cloner-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-importer-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-operator-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadserver-rhel9

  Version range not reported

• container-native-virtualization/virt-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-exportproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-exportserver-rhel9

  Version range not reported

• container-native-virtualization/virt-handler-rhel9

  Version range not reported

• container-native-virtualization/virtio-win-rhel9

  Version range not reported

• container-native-virtualization/virt-launcher-rhel9

  Version range not reported

• container-native-virtualization/virt-operator-rhel9

  Version range not reported

• container-native-virtualization/vm-console-proxy-rhel9

  Version range not reported

• container-native-virtualization/vm-network-latency-checkup-rhel9

  Version range not reported

• container-native-virtualization/wasp-agent-rhel9

  Version range not reported

• container-native-virtualization/aaq-controller-rhel9

  Version range not reported

• container-native-virtualization/aaq-operator-rhel9

  Version range not reported

• container-native-virtualization/aaq-server-rhel9

  Version range not reported

• container-native-virtualization/bridge-marker-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cnv-containernetworking-plugins-rhel9

  Version range not reported

• container-native-virtualization/cnv-must-gather-rhel9

  Version range not reported

• container-native-virtualization/hco-bundle-registry-rhel9

  Version range not reported

• container-native-virtualization/hostpath-csi-driver-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-operator-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel9

  Version range not reported

• container-native-virtualization/kubemacpool-rhel9

  Version range not reported

• container-native-virtualization/kubesecondarydns-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-api-lifecycle-automation-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-apiserver-proxy-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-common-instancetypes-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-console-plugin-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-dpdk-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ipam-controller-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-realtime-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ssp-operator-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-storage-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-template-validator-rhel9

  Version range not reported

• container-native-virtualization/libguestfs-tools-rhel9

  Version range not reported

• container-native-virtualization/multus-dynamic-networks-rhel9

  Version range not reported

• container-native-virtualization/ovs-cni-plugin-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-cni-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9

  Version range not reported

• container-native-virtualization/pr-helper-rhel9

  Version range not reported

• container-native-virtualization/sidecar-shim-rhel9

  Version range not reported

• container-native-virtualization/virt-api-rhel9

  Version range not reported

• container-native-virtualization/virt-artifacts-server-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-apiserver-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-cloner-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-importer-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-operator-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadserver-rhel9

  Version range not reported

• container-native-virtualization/virt-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-exportproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-exportserver-rhel9

  Version range not reported

• container-native-virtualization/virt-handler-rhel9

  Version range not reported

• container-native-virtualization/virtio-win-rhel9

  Version range not reported

• container-native-virtualization/virt-launcher-rhel9

  Version range not reported

• container-native-virtualization/virt-operator-rhel9

  Version range not reported

• container-native-virtualization/vm-console-proxy-rhel9

  Version range not reported

• container-native-virtualization/vm-network-latency-checkup-rhel9

  Version range not reported

• container-native-virtualization/wasp-agent-rhel9

  Version range not reported

• container-native-virtualization/aaq-controller-rhel9

  Version range not reported

• container-native-virtualization/aaq-operator-rhel9

  Version range not reported

• container-native-virtualization/aaq-server-rhel9

  Version range not reported

• container-native-virtualization/bridge-marker-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cnv-containernetworking-plugins-rhel9

  Version range not reported

• container-native-virtualization/cnv-must-gather-rhel9

  Version range not reported

• container-native-virtualization/hco-bundle-registry-rhel9

  Version range not reported

• container-native-virtualization/hostpath-csi-driver-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-operator-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel9

  Version range not reported

• container-native-virtualization/kubemacpool-rhel9

  Version range not reported

• container-native-virtualization/kubesecondarydns-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-api-lifecycle-automation-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-apiserver-proxy-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-common-instancetypes-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-console-plugin-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-dpdk-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ipam-controller-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-realtime-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ssp-operator-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-storage-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-template-validator-rhel9

  Version range not reported

• container-native-virtualization/libguestfs-tools-rhel9

  Version range not reported

• container-native-virtualization/multus-dynamic-networks-rhel9

  Version range not reported

• container-native-virtualization/ocp-virt-validation-checkup-rhel9

  Version range not reported

• container-native-virtualization/ovs-cni-plugin-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-cni-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9

  Version range not reported

• container-native-virtualization/pr-helper-rhel9

  Version range not reported

• container-native-virtualization/sidecar-shim-rhel9

  Version range not reported

• container-native-virtualization/virt-api-rhel9

  Version range not reported

• container-native-virtualization/virt-artifacts-server-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-apiserver-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-cloner-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-importer-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-operator-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadserver-rhel9

  Version range not reported

• container-native-virtualization/virt-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-exportproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-exportserver-rhel9

  Version range not reported

• container-native-virtualization/virt-handler-rhel9

  Version range not reported

• container-native-virtualization/virtio-win-rhel9

  Version range not reported

• container-native-virtualization/virt-launcher-rhel9

  Version range not reported

• container-native-virtualization/virt-operator-rhel9

  Version range not reported

• container-native-virtualization/vm-console-proxy-rhel9

  Version range not reported

• container-native-virtualization/vm-network-latency-checkup-rhel9

  Version range not reported

• container-native-virtualization/wasp-agent-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel8

  Version range not reported

• container-native-virtualization/ocp-virt-validation-checkup-rhel9

  Version range not reported

References 7