Vulnerability-Lookup

CVE-2025-57852 (GCVE-0-2025-57852)

Vulnerability from cvelistv5 – Published: 2025-09-30 14:37 – Updated: 2026-03-06 23:45

Title

Openshift-ai: privilege escalation via excessive /etc/passwd permissions

Summary

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-30 15:27 UTC

CWE

CWE-276 - Incorrect Default Permissions

Assigner

redhat redhat root

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:16981	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:16982	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:16983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:16984	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:17501	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-57852	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2391105	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat OpenShift AI 2.16	Unaffected: sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9 , < * (rpm) cpe:/a:redhat:openshift_ai:2.16::el8
Red Hat	Red Hat OpenShift AI 2.19	Unaffected: sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16 , < * (rpm) cpe:/a:redhat:openshift_ai:2.19::el8
Red Hat	Red Hat OpenShift AI 2.21	Unaffected: sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b , < * (rpm) cpe:/a:redhat:openshift_ai:2.21::el9
Red Hat	Red Hat OpenShift AI 2.22	Unaffected: sha256:1709fa3c79aad4ba7eb9be8299949396092c8e20210124e0c0936385bc04e839 , < * (rpm) cpe:/a:redhat:openshift_ai:2.22::el9
Red Hat	Red Hat OpenShift AI 2.24	Unaffected: sha256:92629b1462ca2ed121dd2f3069a005d78e00e1344d330d6a8710f53ec58b74b8 , < * (rpm) cpe:/a:redhat:openshift_ai:2.24::el9

Date Public

2025-09-30 14:25

Credits

Red Hat would like to thank Antony Di Scala and Michael Whale for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-57852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-30T15:27:58.164163Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-30T15:35:07.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel8",
          "product": "Red Hat OpenShift AI 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.19::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel8",
          "product": "Red Hat OpenShift AI 2.19",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.21::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel9",
          "product": "Red Hat OpenShift AI 2.21",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel9",
          "product": "Red Hat OpenShift AI 2.22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:1709fa3c79aad4ba7eb9be8299949396092c8e20210124e0c0936385bc04e839",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.24::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel9",
          "product": "Red Hat OpenShift AI 2.24",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:92629b1462ca2ed121dd2f3069a005d78e00e1344d330d6a8710f53ec58b74b8",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Antony Di Scala and Michael Whale for reporting this issue."
        }
      ],
      "datePublic": "2025-09-30T14:25:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T23:45:29.053Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:16981",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:16981"
        },
        {
          "name": "RHSA-2025:16982",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:16982"
        },
        {
          "name": "RHSA-2025:16983",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:16983"
        },
        {
          "name": "RHSA-2025:16984",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:16984"
        },
        {
          "name": "RHSA-2025:17501",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:17501"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-57852"
        },
        {
          "name": "RHBZ#2391105",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391105"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-26T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-09-30T14:25:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Openshift-ai: privilege escalation via excessive /etc/passwd permissions",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-276: Incorrect Default Permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-57852",
    "datePublished": "2025-09-30T14:37:10.024Z",
    "dateReserved": "2025-08-21T14:40:40.822Z",
    "dateUpdated": "2026-03-06T23:45:29.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-57852",
      "date": "2026-10-03",
      "epss": "0.00157",
      "percentile": "0.04186"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-57852",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-30T15:27:58.164163Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-30T15:28:00.770Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai:2.16::el8"
              ],
              "defaultStatus": "affected",
              "packageName": "rhoai/odh-modelmesh-rhel8",
              "product": "Red Hat OpenShift AI 2.16",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai:2.19::el8"
              ],
              "defaultStatus": "affected",
              "packageName": "rhoai/odh-modelmesh-rhel8",
              "product": "Red Hat OpenShift AI 2.19",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai:2.21::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhoai/odh-modelmesh-rhel9",
              "product": "Red Hat OpenShift AI 2.21",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai:2.22::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhoai/odh-modelmesh-rhel9",
              "product": "Red Hat OpenShift AI 2.22",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "sha256:1709fa3c79aad4ba7eb9be8299949396092c8e20210124e0c0936385bc04e839",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai:2.24::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhoai/odh-modelmesh-rhel9",
              "product": "Red Hat OpenShift AI 2.24",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "sha256:92629b1462ca2ed121dd2f3069a005d78e00e1344d330d6a8710f53ec58b74b8",
                  "versionType": "rpm"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Antony Di Scala and Michael Whale for reporting this issue."
            }
          ],
          "datePublic": "2025-09-30T14:25:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Low"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-276",
                  "description": "Incorrect Default Permissions",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-06T23:45:29.053Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2025:16981",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:16981"
            },
            {
              "name": "RHSA-2025:16982",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:16982"
            },
            {
              "name": "RHSA-2025:16983",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:16983"
            },
            {
              "name": "RHSA-2025:16984",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:16984"
            },
            {
              "name": "RHSA-2025:17501",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:17501"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2025-57852"
            },
            {
              "name": "RHBZ#2391105",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391105"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2025-08-26T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2025-09-30T14:25:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Openshift-ai: privilege escalation via excessive /etc/passwd permissions",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-276: Incorrect Default Permissions"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2025-57852",
        "datePublished": "2025-09-30T14:37:10.024Z",
        "dateReserved": "2025-08-21T14:40:40.822Z",
        "dateUpdated": "2026-03-06T23:45:29.053Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-57852

Vulnerability from fkie_nvd - Published: 2025-09-30 15:15 - Updated: 2026-06-17 09:43

Severity

6.4 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:16981
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:16982
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:16983
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:16984
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2025:17501
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2025-57852
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2391105

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.16::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel8",
          "product": "Red Hat OpenShift AI 2.16",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:97e2bd9b587f08e135a9aeb9b3e0dc6eafa1a9bdacbb5ecb681ce9bd5aa37fc9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.19::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel8",
          "product": "Red Hat OpenShift AI 2.19",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:53ac36baa374159b9065c718a9ede821bbb61d9ebe9502b2243e0a9f7aca0d16",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.21::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel9",
          "product": "Red Hat OpenShift AI 2.21",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:687c8eeed55f021ecaab1307f0e88b5b16d91f72d63b3d7168d7bbee90e8947b",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel9",
          "product": "Red Hat OpenShift AI 2.22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:1709fa3c79aad4ba7eb9be8299949396092c8e20210124e0c0936385bc04e839",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai:2.24::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhoai/odh-modelmesh-rhel9",
          "product": "Red Hat OpenShift AI 2.24",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "sha256:92629b1462ca2ed121dd2f3069a005d78e00e1344d330d6a8710f53ec58b74b8",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container."
    },
    {
      "lang": "es",
      "value": "Una falla de escalada de privilegios de contenedor fue encontrada en las im\u00e1genes de contenedor de KServe ModelMesh. Este problema se origina en que el archivo /etc /passwd es creado con permisos de escritura para el grupo durante el tiempo de compilaci\u00f3n. En ciertas condiciones, un atacante que puede ejecutar comandos dentro de un contenedor afectado, incluso como un usuario no-root, puede aprovechar su membres\u00eda en el grupo root para modificar el archivo /etc /passwd. Esto podr\u00eda permitir al atacante a\u00f1adir un nuevo usuario con cualquier UID arbitrario, incluyendo UID 0, lo que lleva a privilegios de root completos dentro del contenedor."
    }
  ],
  "id": "CVE-2025-57852",
  "lastModified": "2026-06-17T09:43:32.343",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 5.9,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57852",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-30T15:27:58.164163Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-30T15:15:53.720",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:16981"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:16982"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:16983"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:16984"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:17501"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2025-57852"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391105"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-33J5-FRRM-3WG2

Vulnerability from github – Published: 2025-09-30 15:30 – Updated: 2025-11-07 03:30

Details

Severity

5.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-57852"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-30T15:15:53Z",
    "severity": "MODERATE"
  },
  "details": "A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.",
  "id": "GHSA-33j5-frrm-3wg2",
  "modified": "2025-11-07T03:30:24Z",
  "published": "2025-09-30T15:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57852"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2025:16983"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2025:16984"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:16981"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:16982"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:16983"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:16984"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:17501"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-57852"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391105"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

RHBA-2025:16983

Vulnerability from csaf_redhat - Published: 2025-09-29 17:16 - Updated: 2025-10-02 14:40

Summary

Red Hat Bug Fix Advisory: RHOAI 2.21.0 - Red Hat OpenShift AI

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

5.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L

Fixed: 1 product Known not affected: 9 products

https://access.redhat.com/errata/RHBA-2025:16983

Open the full advisory

RHBA-2025:16984

Vulnerability from csaf_redhat - Published: 2025-09-29 17:16 - Updated: 2025-10-02 15:12

Summary

Red Hat Bug Fix Advisory: RHOAI 2.19.0 - Red Hat OpenShift AI

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

5.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L

Fixed: 1 product Known not affected: 8 products

https://access.redhat.com/errata/RHBA-2025:16984

Open the full advisory

RHSA-2025:16981

Vulnerability from csaf_redhat - Published: 2025-09-29 17:16 - Updated: 2026-09-21 17:05

Summary

Red Hat Security Advisory: RHOAI 2.16.3 - Red Hat OpenShift AI

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known not affected: 3 products

https://access.redhat.com/errata/RHSA-2025:16981

Open the full advisory

RHSA-2025:16982

Vulnerability from csaf_redhat - Published: 2025-09-29 17:16 - Updated: 2026-09-21 17:05

Summary

Red Hat Security Advisory: RHOAI 2.22.2 - Red Hat OpenShift AI

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known not affected: 9 products

https://access.redhat.com/errata/RHSA-2025:16982

Open the full advisory

RHSA-2025:16983

Vulnerability from csaf_redhat - Published: 2025-09-29 17:16 - Updated: 2026-09-21 17:05

Summary

Red Hat Security Advisory: RHOAI 2.21.1 - Red Hat OpenShift AI

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known not affected: 9 products

https://access.redhat.com/errata/RHSA-2025:16983

Open the full advisory

RHSA-2025:16984

Vulnerability from csaf_redhat - Published: 2025-09-29 17:16 - Updated: 2026-09-21 17:05

Summary

Red Hat Security Advisory: RHOAI 2.19.3 - Red Hat OpenShift AI

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known not affected: 8 products

https://access.redhat.com/errata/RHSA-2025:16984

Open the full advisory

RHSA-2025:17501

Vulnerability from csaf_redhat - Published: 2025-10-07 14:43 - Updated: 2026-10-02 00:46

Summary

Red Hat Security Advisory: RHOAI 2.24.0 - Red Hat OpenShift AI

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2025-57852.

CVE-2025-57852

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Fixed: 1 product Known not affected: 117 products

https://access.redhat.com/errata/RHSA-2025:17501

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-57852 (GCVE-0-2025-57852)

Tags

Sightings

Nomenclature

Related by attack behaviour