CVE-2025-5791: Users: `root` appended to group listings
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Other sources
Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.
This affects both:
- The supplementary groups of a user - The group access list of the current process
If the caller uses this information for access control, this may lead to privilege escalation.
This crate is not currently maintained, so a patched version is not available.
Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.
Recommended alternatives - uzers (an actively maintained fork of the users crate) - sysinfo
— Red Hat
Users: root appended to group listings
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.15.0.aks0-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.0.azl2-7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5791?
CVE-2025-5791 has been classified with a high severity due to its potential for privilege escalation.
How do I fix CVE-2025-5791?
To fix CVE-2025-5791, upgrade the Rust users crate to version 0.11.0 or later.
What versions are affected by CVE-2025-5791?
CVE-2025-5791 affects Rust users crate versions between 0.8.0 and 0.11.0.
What kind of vulnerability is CVE-2025-5791?
CVE-2025-5791 is a privilege escalation vulnerability due to incorrect group listing in the Rust users crate.
Who is impacted by CVE-2025-5791?
CVE-2025-5791 impacts users of the Rust users crate that have fewer than 1024 groups.