CVE-2025-58713: Red Hat PAM Privilege Escalation Flaw

CVE-2025-58713 Overview

A container privilege escalation vulnerability has been identified in certain Red Hat Process Automation Manager images. This flaw originates from insecure file permissions applied during the container build process, specifically affecting the /etc/passwd file which is created with group-writable permissions. This misconfiguration enables attackers with container access to potentially escalate their privileges to root level.

Critical Impact

An attacker with command execution capability within an affected container can leverage root group membership to modify /etc/passwd and add a user with UID 0, achieving full root privileges within the container.

Affected Products

• Red Hat Process Automation Manager container images

Discovery Timeline

• April 8, 2026 - CVE-2025-58713 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-58713

Vulnerability Analysis

This vulnerability is classified as CWE-276 (Incorrect Default Permissions), representing a fundamental misconfiguration in the container build process. The security flaw stems from the /etc/passwd file being configured with group-writable permissions during the image build phase, which violates the principle of least privilege for sensitive system files.

The attack requires local access to the container and elevated privileges to execute. However, once these conditions are met, the impact is severe—an attacker gains the ability to fully compromise the container's user authentication system. The exploitation path involves modifying the passwd file to inject a new user entry with UID 0, effectively creating an alternative root account.

This type of vulnerability is particularly concerning in containerized environments where workloads may be shared or where container escape techniques could compound the initial privilege escalation.

Root Cause

The root cause is incorrect default permissions (CWE-276) applied to the /etc/passwd file during the container image build process. The file is created with group-writable permissions, allowing any user who is a member of the root group (but not necessarily the root user) to modify this critical authentication file.

In properly configured systems, /etc/passwd should have permissions of 644 (owner read/write, group read, others read). The vulnerability indicates the file was created with at least 664 permissions, enabling group write access.

Attack Vector

The attack vector is local, requiring the attacker to already have command execution capability within the affected container. The exploitation flow involves:

1. The attacker gains shell access to an affected container, even as a non-root user
2. The attacker identifies their membership in the root group (typically GID 0)
3. Leveraging the group-writable permissions on /etc/passwd, the attacker appends a new user entry
4. The malicious entry specifies UID 0, granting root-equivalent privileges
5. The attacker can then use su or similar utilities to switch to the newly created root user

The vulnerability mechanism involves exploiting the misconfigured file permissions on /etc/passwd. An attacker with root group membership can directly modify this file to add an entry with UID 0, bypassing normal privilege restrictions. For detailed technical information, refer to the Red Hat CVE-2025-58713 Advisory.

Detection Methods for CVE-2025-58713

Indicators of Compromise

• Unexpected modifications to /etc/passwd file within containers, particularly new user entries with UID 0
• Audit logs showing write operations to /etc/passwd by non-root users
• New user accounts appearing in containers that were not part of the original image
• Process execution logs showing privilege escalation sequences (su, sudo) to unexpected accounts

Detection Strategies

• Implement file integrity monitoring (FIM) on critical authentication files including /etc/passwd, /etc/shadow, and /etc/group
• Monitor container audit logs for unauthorized file modifications using tools like auditd or container-native logging
• Deploy runtime security solutions that detect privilege escalation attempts within containers
• Use container image scanning to identify images with incorrect file permissions before deployment

Monitoring Recommendations

• Configure alerts for any write operations to /etc/passwd in production containers
• Implement continuous monitoring for user account creation events within containers
• Enable detailed audit logging for authentication-related files and privilege changes
• Review container images during CI/CD pipeline for permission misconfigurations using tools like Trivy or Grype

How to Mitigate CVE-2025-58713

Immediate Actions Required

• Audit all deployed Red Hat Process Automation Manager container images for the vulnerable file permissions
• Check /etc/passwd permissions using ls -la /etc/passwd and verify they are set to 644 or more restrictive
• Update to patched container images when available from Red Hat
• Implement runtime security controls to prevent unauthorized modifications to system files

Patch Information

Red Hat has acknowledged this vulnerability. Organizations should monitor the Red Hat CVE-2025-58713 Advisory and Red Hat Bug Report #2394419 for updates regarding patched container images. Apply updated images as they become available from Red Hat's container registry.

Workarounds

• Manually correct the /etc/passwd file permissions in running containers: chmod 644 /etc/passwd
• Rebuild affected container images with a step that explicitly sets correct permissions on authentication files
• Implement read-only root filesystem where feasible to prevent runtime modifications
• Use Pod Security Policies or Pod Security Standards to restrict container capabilities and prevent privilege escalation

# Verify and fix passwd file permissions in container
chmod 644 /etc/passwd
chmod 644 /etc/group
ls -la /etc/passwd /etc/group

# Verify no unauthorized users with UID 0 exist
awk -F: '$3 == 0 {print $1}' /etc/passwd