CVE-2025-4437: CRI-O Container Runtime DoS Vulnerability

CVE-2025-4437 Overview

CVE-2025-4437 is a denial-of-service vulnerability in the CRI-O container runtime. The flaw occurs when a container is launched with securityContext.runAsUser referencing a non-existent user. CRI-O responds by reading the container's entire /etc/passwd file into memory to attempt user creation. An attacker who controls the container image can supply an excessively large /etc/passwd file, triggering uncontrolled memory consumption on the host. The resulting out-of-memory condition can terminate the CRI-O process and disrupt other pods and services running on the same Kubernetes node. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A malicious container image combined with a crafted pod specification can exhaust node memory, killing co-tenant workloads and degrading Kubernetes cluster availability.

Affected Products

CRI-O container runtime (as tracked in the Red Hat advisory)
Red Hat OpenShift Container Platform deployments using CRI-O
Kubernetes clusters running CRI-O as the Container Runtime Interface

Discovery Timeline

2025-08-20 - CVE-2025-4437 published to the National Vulnerability Database
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2025-4437

Vulnerability Analysis

CRI-O is a Container Runtime Interface implementation for Kubernetes that manages container lifecycle operations. When a pod specification sets securityContext.runAsUser to a user ID that does not exist inside the container image, CRI-O attempts to resolve the mapping by parsing the container's /etc/passwd. The runtime loads the entire file into memory without enforcing a maximum size limit. A container image containing a multi-gigabyte /etc/passwd forces the runtime to allocate equivalent heap memory on the host. The host kernel's out-of-memory killer then terminates processes to reclaim memory, which can include CRI-O itself or neighboring pods. Because CRI-O runs as a privileged system service on every worker node, the impact extends beyond the attacker's own pod to the entire node.

Root Cause

The root cause is missing input size validation during user lookup. CRI-O trusts the container filesystem contents and reads /etc/passwd in full rather than streaming it line-by-line or capping the acceptable file size. This is a classic unbounded resource allocation flaw [CWE-770].

Attack Vector

Exploitation requires an authenticated user with privileges to create pods and reference a controlled container image. The attacker builds an image containing an oversized /etc/passwd file, then submits a pod specification setting runAsUser to a UID absent from that file. CRI-O's user-creation path triggers the read, and memory consumption scales linearly with the file size. See the Red Hat CVE-2025-4437 Advisory and Red Hat Bug Report #2375084 for additional technical context.

Detection Methods for CVE-2025-4437

Indicators of Compromise

Node-level out-of-memory kill events (oom_kill) targeting the CRI-O process or unrelated pods on the same host
Pods repeatedly stuck in ContainerCreating state with CRI-O logs referencing user-lookup failures
Container images with abnormally large /etc/passwd files pulled from untrusted registries

Detection Strategies

Audit Kubernetes admission logs for pod specifications that set runAsUser to unusual or non-existent UIDs paired with images from unverified sources
Scan container images at the registry layer for oversized configuration files such as /etc/passwd and /etc/group
Correlate kernel OOM events with CRI-O service restarts to identify exploitation attempts in near real time

Monitoring Recommendations

Alert on sustained CRI-O resident memory growth that exceeds historical baselines
Monitor kubelet and CRI-O journal logs for repeated user-resolution errors tied to specific namespaces or service accounts
Track node-level memory pressure conditions and pair them with pod creation timelines for forensic review

How to Mitigate CVE-2025-4437

Immediate Actions Required

Apply the CRI-O security update referenced in the Red Hat CVE-2025-4437 Advisory as soon as it is available for your distribution
Restrict pod creation privileges to trusted service accounts and enforce image provenance through signed registries
Enforce Kubernetes resource quotas and memory limits at the namespace level to contain OOM blast radius

Patch Information

Refer to the vendor advisories for fixed package versions. Red Hat tracks remediation for CRI-O and OpenShift Container Platform in the Red Hat CVE-2025-4437 Advisory and Bugzilla #2375084. Apply distribution-specific updates on all Kubernetes worker nodes and restart the CRI-O service to activate the fix.

Workarounds

Use admission controllers such as OPA Gatekeeper or Kyverno to reject pod specifications that reference non-existent user IDs or untrusted images
Require images to pass registry-side policy checks that cap the size of system files like /etc/passwd before admission
Set node-level cgroup memory limits for the CRI-O service so that excessive allocations fail safely without killing neighboring workloads

bash

# Example Kyverno policy fragment restricting runAsUser to known UIDs
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-runasuser
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-runasuser-range
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "runAsUser must be within approved UID range"
        pattern:
          spec:
            securityContext:
              runAsUser: "1000-65535"