CVE-2025-5791: Rust User Crate Privilege Escalation Flaw

CVE-2025-5791 Overview

CVE-2025-5791 affects the users crate for Rust, a library that provides Unix user and group lookups. The flaw causes incorrect group listing when a user or process belongs to fewer than exactly 1024 groups. Under this condition, the root group is erroneously included in the returned access list. Applications that consume this list for authorization decisions can grant elevated privileges to unprivileged local users. The issue is tracked as [CWE-266: Incorrect Privilege Assignment] and is documented in RustSec Advisory RUSTSEC-2025-0040 and Red Hat CVE Report CVE-2025-5791.

Critical Impact
Local users can obtain root group membership in applications relying on the users crate for group enumeration, enabling privilege escalation and unauthorized access to root-owned resources.

Affected Products

The users crate published on crates.io (Crates.io Users Documentation)
Rust applications and services linking the affected users crate for group enumeration
Red Hat products shipping the affected crate, addressed in Red Hat Security Erratum RHSA-2025:12359

Discovery Timeline

2025-06-06 - CVE-2025-5791 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5791

Vulnerability Analysis

The users crate exposes helper functions to enumerate the supplementary groups of a user or process. Internally, these helpers wrap the getgrouplist and getgroups system calls, which write group IDs into a caller-provided buffer. The affected code paths mishandle the buffer sizing and return values when the total group count is below 1024. As a result, uninitialized or stale buffer entries, including group ID 0 (root), are surfaced to callers as if they were legitimate group memberships. Applications that trust this list for permission checks then treat the calling user as a member of the root group. See GitHub Issue #44 for Rust Users and Red Hat Bug Report #2370001 for the upstream discussion.

Root Cause

The root cause is an incorrect handling of the fixed-size group buffer allocated by the crate. When the actual group count is less than 1024, unused slots in the buffer are not filtered out before the results are returned. Because the buffer starts zero-initialized or is read past the valid range, entries default to 0, which corresponds to the root group on Unix systems. The crate returns the padded buffer instead of slicing it to the count reported by the underlying syscall.

Attack Vector

Exploitation requires local access with valid low-privilege credentials. An attacker runs any process that queries its own group memberships through an application built on the vulnerable crate. Because the returned list falsely contains GID 0, downstream authorization logic that checks group membership grants access as if the user were in the root group. This can be used to read root-owned files, invoke privileged code paths, or bypass group-based access control lists (ACLs) enforced by the calling application.

No verified public exploit code is available. See the RustSec Advisory RUSTSEC-2025-0040 for technical details.

Detection Methods for CVE-2025-5791

Indicators of Compromise

Unexpected access to root-owned files or directories by processes running under non-root user accounts.
Application logs recording group ID 0 in effective group lists for users not administratively assigned to the root group.
Successful invocation of privileged application features by low-privilege local accounts.

Detection Strategies

Inventory Rust binaries and services in your environment and check their dependency trees for the users crate using cargo tree or SBOM tooling.
Correlate authorization decisions in application logs with system group membership from /etc/group and id output to spot discrepancies.
Flag any code path that treats the output of the crate's group listing functions as authoritative without cross-checking against getgrgid or id -G.

Monitoring Recommendations

Enable Linux audit rules on access to root-owned sensitive paths and monitor process credentials on those events.
Alert on unexpected setgid or group-based access grants in application audit logs.
Track dependency updates and advisories via RustSec and vendor channels such as Red Hat CVE Report CVE-2025-5791.

How to Mitigate CVE-2025-5791

Immediate Actions Required

Identify all Rust applications depending on the users crate and prioritize services that make authorization decisions using group membership.
Update the users crate to the fixed version referenced in RustSec Advisory RUSTSEC-2025-0040 and rebuild affected binaries.
Apply the Red Hat update from Red Hat Security Erratum RHSA-2025:12359 on Red Hat systems.

Patch Information

Red Hat has published fixes through RHSA-2025:12359. Upstream remediation guidance and version details are tracked in RustSec Advisory RUSTSEC-2025-0040 and the upstream GitHub Issue #44. Rebuild and redeploy all dependent binaries after upgrading, because Rust dependencies are statically linked.

Workarounds

Filter the crate's group enumeration output in application code, explicitly removing GID 0 unless the user is administratively expected to be a root group member.
Cross-validate group membership against getgrouplist results or id -G output before making authorization decisions.
Restrict local access to affected hosts and enforce least privilege on service accounts until patched builds are deployed.

bash

# Verify whether a Rust binary depends on the affected crate
cargo tree -i users

# Confirm actual group membership from the OS as a cross-check
id -Gn <username>