This vulnerability arises from incorrect default permissions on the /etc/passwd file in certain Container-native Virtualization images, allowing group-writable access. An attacker able to execute commands inside the container and belonging to the root group can exploit this to modify /etc/passwd, adding new users with arbitrary UIDs, including root, thus escalating privileges within the container. Red Hat rates this as moderate severity but notes that OpenShift's default multi-layered security posture, including restrictive SCC profiles and SELinux mandatory access controls, effectively prevent exploitation. The issue is specific to container environments and does not affect standard RHEL installations. Red Hat has released updated OpenShift Virtualization 4.19.14 images containing fixes for this vulnerability.

If exploited, this vulnerability allows an attacker with local command execution and root group membership inside a container to escalate privileges to full root within that container by modifying /etc/passwd. This could compromise container integrity and confidentiality. However, OpenShift's default security mechanisms, such as SCC and SELinux, mitigate the risk by restricting container permissions and enforcing strict isolation. The vulnerability does not affect host systems or containers without the specific permissive configuration. No known exploits are reported in the wild.

Red Hat OpenShift's default Security Context Constraints and SELinux policies effectively mitigate this vulnerability by restricting container permissions and preventing privilege escalation. Users should ensure they are running containers with the default or similarly restrictive SCC profiles. Red Hat has released updated OpenShift Virtualization 4.19.14 images that include fixes for this issue; applying these updates is recommended. For other container runtimes, users should evaluate their security controls on a case-by-case basis. No additional immediate action is required if using OpenShift with default security settings.