Osus-operator: privilege escalation via excessive /etc/passwd permissions

The core of the vulnerability lies in the group-writable permissions assigned to the /etc/passwd file during the build process of affected OSUS images. An attacker who can execute commands within a container, even with non-root privileges, can exploit this by leveraging their membership in the root group. By modifying the /etc/passwd file, the attacker can create a new user with an arbitrary UID, including UID 0 (root). This grants them complete control over the container, enabling them to execute arbitrary commands, access sensitive data, and potentially compromise the underlying host system if container breakout is possible. The blast radius extends to any data or services accessible within the container, and the potential for lateral movement depends on the container's network configuration and access to other resources.

Organizations utilizing Red Hat OpenShift Update Service in production environments, particularly those running versions 1.0.0 through 2.5.3, are at risk. Environments with less stringent container security policies or those relying on default configurations are especially vulnerable. Shared hosting environments using OSUS also face increased risk due to the potential for cross-container contamination.

• linux / server:

journalctl -u osus -g 'passwd modification'

• linux / server:

find / -perm -g+w -name 'passwd' 2>/dev/null

• linux / server:

ps aux | grep -i passwd

1. 2026-04-08Disclosure

   disclosure

1. Reservado2025-08-21
2. Publicada2026-04-08
3. EPSS atualizado2026-04-16

The primary mitigation for CVE-2025-57854 is to upgrade to Red Hat OpenShift Update Service version 2.5.4 or later, which includes a fix for the group-writable permissions issue. If an immediate upgrade is not feasible, consider implementing stricter container security policies to limit the potential impact of a successful exploitation. This includes restricting container privileges, implementing strong access controls, and regularly auditing container configurations. While not a direct fix, using a Web Application Firewall (WAF) or reverse proxy can help detect and block malicious requests attempting to exploit the vulnerability. Monitor container logs for suspicious activity, particularly attempts to modify the /etc/passwd file. After upgrading, verify the fix by attempting to create a new user with UID 0 within an affected container and confirming that the operation fails.