Operator-SDK Privilege Escalation Vulnerability via Insecure /etc/passwd Permissions

A privilege escalation vulnerability has been identified in early versions of Operator-SDK, specifically those prior to 0.15.2. The issue arises from the 'user_setup' script, which modifies the '/etc/passwd' file permissions to 664 during the build process, making it group-writable. This vulnerability affects operator containers running in environments with random UID assignments. An attacker with command execution capabilities in the container, even as a non-root user, could exploit their membership in the root group to alter the '/etc/passwd' file. This manipulation could involve adding a new user with an arbitrary UID, including UID 0, thereby gaining full root privileges within the container.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to gain root access within the affected container.