{"id":"CVE-2025-5791","state":"PUBLISHED","title":"Users: `root` appended to group listings","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","publishedAt":"2025-06-06T13:10:07.157Z","updatedAt":"2025-11-20T07:41:09.666Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"redhat"},"assigner":"redhat","products":["rust-users","Red Hat Red Hat OpenShift sandboxed containers 1.1","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat Trusted Profile Analyzer"],"affected":[{"packageName":"rust-users","defaultStatus":"unaffected","versions":[{"version":"0.8.0","status":"affected","lessThan":"0.11.1","versionType":"semver"}],"collectionURL":"https://github.com/ogham/rust-users/"},{"vendor":"Red Hat","product":"Red Hat OpenShift sandboxed containers 1.1","packageName":"openshift-sandboxed-containers/osc-rhel9-operator","defaultStatus":"affected","versions":[{"version":"sha256:a6f29da891174e57fcfd131da7aa90c50459ba24164111b83120a1b91f2eabba","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rust-ssh-key-dir","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rust-afterburn","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"kata-containers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"rust-afterburn","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Trusted Profile Analyzer","packageName":"rhtpa/rhtpa-trustification-service-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:1"]}],"references":["https://access.redhat.com/errata/RHSA-2025:12359","https://access.redhat.com/security/cve/CVE-2025-5791","https://bugzilla.redhat.com/show_bug.cgi?id=2370001","https://crates.io/crates/users","https://github.com/ogham/rust-users/issues/44","https://rustsec.org/advisories/RUSTSEC-2025-0040.html"],"weaknesses":["CWE-266"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5791.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-5791","state":"PUBLISHED","datePublished":"2025-06-06T13:10:07.157Z","dateUpdated":"2025-11-20T07:41:09.666Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-06-06T08:09:10.242Z"},"containers":{"cna":{"title":"Users: `root` appended to group listings","descriptions":[{"lang":"en","value":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list."}],"affected":[{"packageName":"rust-users","defaultStatus":"unaffected","versions":[{"version":"0.8.0","status":"affected","lessThan":"0.11.1","versionType":"semver"}],"collectionURL":"https://github.com/ogham/rust-users/"},{"vendor":"Red Hat","product":"Red Hat OpenShift sandboxed containers 1.1","packageName":"openshift-sandboxed-containers/osc-rhel9-operator","defaultStatus":"affected","versions":[{"version":"sha256:a6f29da891174e57fcfd131da7aa90c50459ba24164111b83120a1b91f2eabba","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"rust-ssh-key-dir","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"rust-afterburn","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"kata-containers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"rust-afterburn","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Trusted Profile Analyzer","packageName":"rhtpa/rhtpa-trustification-service-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:1"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:12359","name":"RHSA-2025:12359","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5791","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370001","name":"RHBZ#2370001","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://crates.io/crates/users"},{"url":"https://github.com/ogham/rust-users/issues/44"},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0040.html"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-266","description":"Incorrect Privilege Assignment","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-20T07:41:09.666Z"},"datePublic":"2025-01-15T12:00:00.000Z","x_redhatCweChain":"CWE-266: Incorrect Privilege Assignment","timeline":[{"lang":"en","time":"2025-06-03T13:02:24.781Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-01-15T12:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-06T13:40:43.009202Z","id":"CVE-2025-5791","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-06T13:40:47.773Z"}}]}}}