Osus-operator: Rechteeskalation über übermäßige /etc/passwd Berechtigungen

The primary impact of CVE-2025-57854 is the potential for an attacker to escalate their privileges to root within a container. This allows them to execute arbitrary commands with the highest level of access, effectively taking control of the container's environment. An attacker could then access sensitive data stored within the container, modify system configurations, or even use the compromised container as a launchpad for lateral movement within the broader infrastructure. The blast radius extends to any data or services hosted within the affected container. While the vulnerability requires command execution within the container, the ease of achieving this in some scenarios makes it a significant risk, particularly in environments where containers are used to host critical applications or sensitive data.

Organizations utilizing Red Hat OpenShift Update Service in production environments, particularly those running versions 1.0.0 through 2.5.3, are at risk. Environments with less stringent container security policies or those relying on default configurations are especially vulnerable. Shared hosting environments using OSUS also face increased risk due to the potential for cross-container contamination.

• linux / server:

journalctl -u osus -g 'passwd modification'

• linux / server:

find / -perm -g+w -name 'passwd' 2>/dev/null

• linux / server:

ps aux | grep -i passwd

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2025-08-21
2. Veröffentlicht2026-04-08
3. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2025-57854 is to upgrade Red Hat OpenShift Update Service to version 2.5.4 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict access to the container to only authorized users and processes. Implement strict container resource limits to minimize the potential impact of a successful exploit. Monitor container logs for suspicious activity, particularly attempts to modify the /etc/passwd file. Consider using a Web Application Firewall (WAF) or reverse proxy to filter traffic and block malicious requests. After upgrading, verify the fix by attempting to create a new user with UID 0 within a container running the patched version; this should fail.