CVE-2024-25621
BaseFortify
Publication date: 2025-11-06
Last updated on: 2025-12-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | containerd | to 1.7.29 (exc) |
| linuxfoundation | containerd | From 2.0.0 (inc) to 2.0.7 (exc) |
| linuxfoundation | containerd | From 2.1.0 (inc) to 2.1.5 (exc) |
| linuxfoundation | containerd | 2.2.0 |
| linuxfoundation | containerd | 2.2.0 |
| linuxfoundation | containerd | 2.2.0 |
| linuxfoundation | containerd | 2.2.0 |
| linuxfoundation | containerd | 2.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-279 | While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in containerd involves overly broad default permissions on certain directory paths such as /var/lib/containerd and others. These directories were created with incorrect permissions that allow more access than intended, potentially exposing sensitive data or allowing unauthorized actions. The issue affects multiple versions of containerd and is fixed in later versions.
How can this vulnerability impact me? :
The overly broad permissions can lead to unauthorized access or modification of container runtime data, which may compromise confidentiality, integrity, and availability of container workloads. This could allow attackers with limited privileges to escalate their access or disrupt container operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the permissions of the directories `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri`, and `/run/containerd/io.containerd.sandbox.controller.v1.shim`. Use commands like `ls -ld /var/lib/containerd /run/containerd/io.containerd.grpc.v1.cri /run/containerd/io.containerd.sandbox.controller.v1.shim` to inspect their permissions. If these directories have group or world accessible permissions, the system may be vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the permissions of the affected directories to remove group and world access using commands such as `chmod go-rwx /var/lib/containerd /run/containerd/io.containerd.grpc.v1.cri /run/containerd/io.containerd.sandbox.controller.v1.shim`. Alternatively, running containerd in rootless mode can also mitigate the issue. Ultimately, updating containerd to fixed versions 1.7.29, 2.0.7, 2.1.5, or 2.2.0 is recommended.