A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
A privilege escalation vulnerability in Red Hat Process Automation Manager container images allows non-root users to modify /etc/passwd due to improper group-writable permissions set during build time. An attacker with container execution capabilities can add arbitrary users with UID 0 to gain full root privileges. This poses significant risk to organizations running containerized automation workflows, particularly in Saudi financial and government sectors relying on Red Hat technologies.
IMMEDIATE ACTIONS:
1. Audit all Red Hat Process Automation Manager container deployments to identify affected image versions
2. Implement network segmentation to restrict container-to-host communication
3. Enable container runtime security monitoring (AppArmor/SELinux enforcement)
4. Review container execution policies to restrict non-root user capabilities
COMPENSATING CONTROLS (until patch available):
5. Rebuild container images with corrected /etc/passwd permissions (chmod 644 /etc/passwd, verify group ownership is root:root)
6. Implement Pod Security Standards (PSS) with restricted profile
7. Use read-only root filesystem where possible
8. Enforce securityContext with runAsNonRoot=true and allowPrivilegeEscalation=false
9. Deploy container image scanning to detect permission misconfigurations
10. Monitor /etc/passwd modifications within containers using auditd or container runtime hooks
DETECTION:
- Alert on file permission changes to /etc/passwd within containers
- Monitor for new UID 0 user creation attempts
- Track group membership changes for root group
الإجراءات الفورية:
1. تدقيق جميع نشرات Red Hat Process Automation Manager لتحديد إصدارات الصور المتأثرة
2. تطبيق تقسيم الشبكة لتقييد الاتصال بين الحاوية والمضيف
3. تفعيل مراقبة أمان وقت تشغيل الحاوية (فرض AppArmor/SELinux)
4. مراجعة سياسات تنفيذ الحاوية لتقييد قدرات المستخدم غير الجذر
الضوابط البديلة (حتى توفر التصحيح):
5. إعادة بناء صور الحاوية بأذونات /etc/passwd صحيحة
6. تطبيق معايير أمان Pod المقيدة
7. استخدام نظام ملفات الجذر للقراءة فقط حيثما أمكن
8. فرض securityContext مع runAsNonRoot=true
9. نشر فحص صور الحاوية
10. مراقبة تعديلات /etc/passwd داخل الحاويات