Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update
🔗 CVE IDs covered (1)
📋 Description
CVE-2025-7195 — operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
🎯 Affected products5
- Compliance Operator 1
- registry.redhat.io/compliance/openshift-file-integrity-operator-bundle@sha256:efb25a29f837eebee8a0b566eb2c8cf8cebce7cb16198e90d87231fe3cc35316_amd64 as a component of Compliance Operator 1
- registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:1d10b1fd2f76dd5e8c97c38747e621c39aca11b7b64cb820c1264680b7686138_amd64 as a component of Compliance Operator 1
- registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:822fc16687164f666df5e498030bec3d3ab1e07d0a0576cc133a468e4ea01cf2_ppc64le as a component of Compliance Operator 1
- registry.redhat.io/compliance/openshift-file-integrity-rhel8-operator@sha256:ef2ee875f55a754e5d3f3d75654f429d33357f0e83f955575ebe67f0634bb715_s390x as a component of Compliance Operator 1
✅ Remediation
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html Workaround: In Red Hat OpenShift Container Platform, the following default configurations reduce the impact of this vulnerability. Security Context Constraints (SCCs): The default SCC, Restricted-v2, applies several crucial security settings to containers. Capabilities: drop: ALL removes all Linux capabilities, including SETUID and SETGID. This prevents a process from changing its user or group ID, a common step in privilege escalation attacks. The SETUID and SETGID capabilities can also be dropped explicitly if other capabilities are still required. allowPrivilegeEscalation: false ensures that a process cannot gain more privileges than its parent process. This blocks attempts by a compromised container process to grant itself additional capabilities. SELinux Mandatory Access Control (MAC): Pods are required to run with a pre-allocated Multi-Category Security (MCS) label. This SELinux feature provides a strong layer of isolation between containers and from the host system. A properly configured SELinux policy can prevent a container escape, even if an attacker gains elevated permissions within the container itself. Filesystem Hardening: While not a default setting, a common security practice is to set readOnlyRootFilesystem: true in a container's security context. In this specific scenario, this configuration would prevent an attacker from modifying critical files like /etc/passwd, even if they managed to gain file-level write permissions.