← CVE Intelligence

CVE-2025-8766

Noobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container PUBLISHED

Description (CNA)

A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782932114 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782931768 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782932104 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783536000 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783535989 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783536515 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782932521 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783018461 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783018421 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782932812 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783537001 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782932919 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783537586 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782932969 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782933015 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782933042 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783537392 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782933235 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782933251 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783537955 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782933417 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783537742 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782933602 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1783019377 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782934054 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782934036 before *
Red Hat / Red Hat Openshift Data Foundation 4.22unaffected 1782934284 before *

CWE

CWE-276

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container