A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
References
Configurations
No configuration.
History
07 Nov 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2025-09-30 15:15
Updated : 2025-11-07 01:15
NVD link : CVE-2025-57852
Mitre link : CVE-2025-57852
CVE.ORG link : CVE-2025-57852
JSON object : View
Products Affected
No product.
CWE
CWE-276
Incorrect Default Permissions