Description
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | <= 1.33.3 | — | GHSA-8f93-j3fx-72f3 |
| Go | github.com/cri-o/cri-o | all versions | — | GO-2025-3897 |
References
- https://access.redhat.com/security/cve/CVE-2025-4437 vdb-entry
- RHBZ#2375084 issue-tracking