CVE-2025-4437: Cri-o: large /etc/passwd file may lead to denial of service
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
Other sources
When running a container using the securityContext.runAsUser setting to specify which user the container should use to be ran, if the requested user is not present in the '/etc/passwd' file in the container image, cri-o tries to create the new user information. For that cri-o reads the passwd file into the memory all at once using os.ReadFile() function, if the read passwd file is too big it can lead to increased memory consumption, eventually resulting in a Denial of Service.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4437?
CVE-2025-4437 is a medium severity vulnerability due to its potential to cause excessive memory consumption when processing large /etc/passwd files.
How do I fix CVE-2025-4437?
To mitigate CVE-2025-4437, ensure that container configurations do not specify non-existent users in securityContext.runAsUser.
What impact does CVE-2025-4437 have on container security?
CVE-2025-4437 can lead to denial of service by consuming excessive memory resources in the container.
Which versions of CRI-O are affected by CVE-2025-4437?
CRI-O versions up to and including 1.33.3 are affected by CVE-2025-4437.
Is there a workaround for CVE-2025-4437?
A possible workaround for CVE-2025-4437 is to validate user configurations before launching containers to prevent specifying non-existent users.