Bug 2375084 (CVE-2025-4437)

Summary: CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2375091, 2375092, 2375093, 2375094, 2375095, 2375086, 2375087, 2375088, 2375089, 2375090, 2375096    
Bug Blocks:    

Description OSIDB Bzimport 2025-06-26 22:20:38 UTC 
When running a container using the `securityContext.runAsUser` setting to specify which user the container should use to be ran, if the requested user is not present in the '/etc/passwd' file in the container image, cri-o tries to create the new user information. For that cri-o reads the passwd file into the memory all at once using os.ReadFile() function, if the read passwd file is too big it can lead to increased memory consumption, eventually resulting in a Denial of Service.