CVE-2024-25621

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-06

Last updated on: 2025-12-31

Assigner: GitHub, Inc.

Description

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-06

Last Modified

2025-12-31

Generated

2026-07-06

AI Q&A

2025-11-06

EPSS Evaluated

2026-07-05

NVD

CVE-2024-25621

EUVD

EUVD-2024-22942

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	containerd	to 1.7.29 (exc)
linuxfoundation	containerd	From 2.0.0 (inc) to 2.0.7 (exc)
linuxfoundation	containerd	From 2.1.0 (inc) to 2.1.5 (exc)
linuxfoundation	containerd	2.2.0
linuxfoundation	containerd	2.2.0
linuxfoundation	containerd	2.2.0
linuxfoundation	containerd	2.2.0
linuxfoundation	containerd	2.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-279	While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

Attack-Flow Graph

Executive Summary

This vulnerability in containerd involves overly broad default permissions on certain directory paths such as /var/lib/containerd and others. These directories were created with incorrect permissions that allow more access than intended, potentially exposing sensitive data or allowing unauthorized actions. The issue affects multiple versions of containerd and is fixed in later versions.

Impact Analysis

The overly broad permissions can lead to unauthorized access or modification of container runtime data, which may compromise confidentiality, integrity, and availability of container workloads. This could allow attackers with limited privileges to escalate their access or disrupt container operations.

Detection Guidance

You can detect this vulnerability by checking the permissions of the directories `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri`, and `/run/containerd/io.containerd.sandbox.controller.v1.shim`. Use commands like `ls -ld /var/lib/containerd /run/containerd/io.containerd.grpc.v1.cri /run/containerd/io.containerd.sandbox.controller.v1.shim` to inspect their permissions. If these directories have group or world accessible permissions, the system may be vulnerable.

Mitigation Strategies

Immediate mitigation steps include updating the permissions of the affected directories to remove group and world access using commands such as `chmod go-rwx /var/lib/containerd /run/containerd/io.containerd.grpc.v1.cri /run/containerd/io.containerd.sandbox.controller.v1.shim`. Alternatively, running containerd in rootless mode can also mitigate the issue. Ultimately, updating containerd to fixed versions 1.7.29, 2.0.7, 2.1.5, or 2.2.0 is recommended.

Hi! I’m here to help you understand CVE-2024-25621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70