PT-2025-43557 · Unknown · Container-Native Virtualization

Published 2025-10-23 · Updated 2026-03-07 · CVE-2025-57848

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Container-native Virtualization (affected versions not specified)

Description A flaw exists that allows for privilege escalation within containers. The issue arises from the /etc/passwd file being created with group-writable permissions during the image build process. An attacker with the ability to execute commands inside an affected container, even without root privileges, can exploit their root group membership to modify the /etc/passwd file. This modification can involve adding a new user with an arbitrary UID, potentially including UID 0, which grants full root access within the container.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-57848

Affected Products

Container-Native Virtualization

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-57848 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2391099 · Note
• https://access.redhat.com/security/cve/CVE-2025-57848 · Note
• https://t.me/CVEtracker/35609 · Telegram Post
• https://twitter.com/CVEnew/status/1990786253030039718 · Twitter Post
• https://t.me/cveNotify/154550 · Telegram Post