CVE-2025-5791
Fixed in a distro release EPSS <1%CVSS 7.1
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Products: Red Hat OpenShift sandboxed containers 1.1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Trusted Profile Analyzer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| crates.io | users | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | toda | 0 |
| SUSE Linux Enterprise Micro 5.2 | afterburn | 5.9.0.git21.a73f509-150300.3.5.1 |
| SUSE Linux Enterprise Micro 5.3 | afterburn | 5.9.0.git21.a73f509-150400.3.3.1 |
| SUSE Linux Enterprise Micro 5.4 | afterburn | 5.9.0.git21.a73f509-150400.3.3.1 |
| SUSE Linux Enterprise Micro 5.5 | afterburn | 5.9.0.git21.a73f509-150500.3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | himmelblau | 0.7.17+git.0.1ebdab0-150700.3.3.2 |
| SUSE Linux Micro 6.0 | afterburn | 5.9.0.git21.a73f509-1.1 |
| SUSE Linux Micro 6.0 | afterburn | 5.10.0.git73.b97f772-1.1 |
| SUSE Linux Micro 6.1 | afterburn | 5.9.0.git21.a73f509-slfo.1.1_1.1 |
| SUSE Linux Micro 6.1 | afterburn | 5.10.0.git73.b97f772-slfo.1.1_1.1 |
| Ubuntu 20.04 LTS | rust-users | no fix |
| Ubuntu 22.04 LTS | rust-users | no fix |
| Ubuntu 24.04 LTS | rust-users | no fix |
| openSUSE Tumbleweed | afterburn | 5.8.2-3.1 |
| openSUSE Tumbleweed | agama | 17+60.68fdb92ec-26.1 |
| openSUSE Tumbleweed | flake-pilot | 3.1.19-1.1 |
| openSUSE Tumbleweed | lsd | 1.2.0-1.1 |
| openSUSE Tumbleweed | mirrorsorcerer | 0.1.3~1-1.1 |