CVE-2024-2905
Rpm-ostree: world-readable /etc/shadow file
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
Timeline
ID reserved
By redhat
- 30 days later
· 30 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | Medium6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Deferred | 3.1 | Medium6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.2.
Weakness
Affected products
rpm-ostree
- affected 1.2024.4
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:2025.5-1.el10 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:2024.3-3.el9_4 – < *
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update Support
- unaffected 0:2023.3-2.el9_2 – < *
Red Hat · Red Hat Enterprise Linux 8
All versions: unaffected
Red Hat · Red Hat OpenShift Container Platform 4
All versions: unaffected
What to do
Workaround: If you need to apply the fix immediately, you can run the following commands, using credentials that have administrator access to an OpenShift cluster: # List current permissions for all nodes for node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- bash -c "ls -alhZ /host/etc/*shadow*"; done # Set correct permissions for node in $( oc get nodes -oname) ; do echo $node ; oc debug $node -- chmod --verbose 0000 /host/etc/shadow /host/etc/gshadow /host/etc/shadow- /host/etc/gshadow-; done As a precaution, we recommend rotating all user credentials stored in those files.
References (8)
- RHBA-2025:4872 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2024:3401 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2024:3823 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- https://access.redhat.com/security/cve/CVE-2024-2905 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
- RHBZ#2271585 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred
- https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6 (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GXY3JLZC645RGFTFWSXPCYM2VWUGIDY5/ (opens in a new tab)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ULCEMTHAQ3GRGL4G2ZQDX43A67P6UXQH/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-2905)Record last updated .