CVE-2025-57854

OVERVIEW CVE-2025-57854 is a container privilege escalation vulnerability affecting OpenShift Update Service (OSUS) images. The flaw exists because the /etc/passwd file is created with group-writable permissions during the container build process. An attacker with command execution privileges inside an affected container, even without root access, can exploit group membership in the root group to modify /etc/passwd and inject a new user account with UID 0, thereby obtaining full root privileges within the container. SEVERITY This vulnerability has a CVSS v3.1 score of 6.4 (Medium) with a local attack vector, high attack complexity, and high privileges required. The impact assessment indicates high confidentiality, integrity, and availability concerns. While the attack requires legitimate container access and elevated group membership, successful exploitation would grant complete container compromise with root-level capabilities, enabling lateral movement, persistence, and further system access. EXPLOITATION STATUS Currently, there is no indication of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on threat tracking lists. The EPSS score of 0.00004 reflects very low probability of exploitation, suggesting minimal community attention and no publicly available exploit code at this time.