There’s a vulnerability in the CRI-O application where when a container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container’s entire /etc/passwd file into memory. If this file is excessively large, it can cause high memory consumption, leading applications to be killed due to out-of-memory. As a result, a denial-of-service can be achieved, possibly disrupting other pods and services running on the same host.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.7 | CVE-2025-4437 |
Exploitation
To exploit this vulnerability, an attacker can launch a container with a security context that specifies a non-existent user. This action triggers CRI-O to read the entire /etc/passwd file into memory, which can lead to excessive memory usage and potentially cause denial-of-service conditions for other applications running on the same host.
Affected Products
- CRI-O: A container runtime that may be affected when improperly configured to use non-existent users.
Mitigation
To mitigate this vulnerability, ensure that the securityContext.runAsUser is set to a valid user that exists within the container. Additionally, monitor memory usage and consider implementing resource limits to prevent denial-of-service conditions.