CVE-2025-57847 is a container privilege escalation flaw in Red Hat Ansible Automation Platform 2.5 images. The vulnerability arises because the /etc/passwd file is created with group-writable permissions during the build process. If an attacker can execute commands inside the container and is a member of the root group, they can modify /etc/passwd to add a new user with any UID, including UID 0, effectively gaining root privileges inside the container. Red Hat states that OpenShift's default Security Context Constraints and SELinux policies mitigate this risk effectively. The vulnerability is rated moderate severity for OpenShift but may have different impacts in other container environments. The issue is addressed by updated container images released by Red Hat.

The vulnerability allows an attacker with command execution inside an affected container and root group membership to escalate privileges to root within that container by modifying /etc/passwd. This could lead to full root access inside the container environment. However, in OpenShift environments, default security mechanisms such as Security Context Constraints and SELinux provide effective mitigation, reducing the practical impact. The vulnerability does not affect the host system or other containers directly. The flaw is due to incorrect file permissions set during image build.

Red Hat has released updated container images for Ansible Automation Platform 2.5 that fix the incorrect permissions on /etc/passwd. Users should apply these updates after ensuring all prior relevant errata are applied. For OpenShift users, the default security posture effectively mitigates this vulnerability, so no additional action may be required beyond applying updates. For other container runtimes, users should evaluate their environment's security controls and apply the updated images promptly. Refer to Red Hat's official advisory and upgrade documentation for detailed instructions.