A flaw in CRI‑O, stemming from an incorrect fix for a prior vulnerability, permits injection of newline characters into the HOME environment variable when an attacker can set container environment variables. The newline is interpreted at startup, allowing arbitrary lines to be appended to the host’s /etc/passwd file. This introduces new user accounts that can run with elevated privileges, granting a persistent local privilege escalation on the host. The weakness is an improper handling of control characters (CWE‑116) and an improper constraint on output (CWE‑134).

The vulnerability affects Red Hat Confidential Compute Attestation and Red Hat OpenShift Container Platform 4, as both incorporate CRI‑O. No specific version numbers are supplied, so any deployment of CRI‑O within these platforms is considered vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires an attacker to have permissions to create or modify container workloads with the ability to set environment variables; once the newline is processed during container start, the attacker obtains a persistent privileged account on the host.