Bug 2370001 (CVE-2025-5791, RUSTSEC-2025-0040) - CVE-2025-5791 users: `root` appended to group listings
Summary: CVE-2025-5791 users: `root` appended to group listings
Keywords:
Status: NEW
Alias: CVE-2025-5791, RUSTSEC-2025-0040
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2370604 2370605 2370606
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-03 13:02 UTC by OSIDB Bzimport
Modified: 2025-06-06 13:03 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-06-03 13:02:48 UTC
Affected versions append `root` to group listings, unless the correct listing
has exactly 1024 groups.

This affects both:

- The supplementary groups of a user
- The group access list of the current process

If the caller uses this information for access control, this may lead to
privilege escalation.

This crate is not currently maintained, so a patched version is not available.

Versions older than 0.8.0 do not contain the affected functions, so downgrading
to them is a workaround.

## Recommended alternatives
- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)
- [`sysinfo`](https://crates.io/crates/sysinfo)

Comment 2 Jens Reimann 2025-06-03 14:29:48 UTC
We're not using the `users` crate:

```
➜  trustify git:(main) cargo tree -i users
error: package ID specification `users` did not match any packages

help: a package with a similar name exists: `aes`
```


Note You need to log in before you can comment on or make changes to this bug.