CVE-2024-25621

HIGH EPSS 4.2%
Published Nov 6, 20257mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Nov 6, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
4.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-279

Affected Products 8

VendorProductVersionRange
linuxfoundationcontainerd* <1.7.29
linuxfoundationcontainerd*≥2.0.0  –  <2.0.7
linuxfoundationcontainerd*≥2.1.0  –  <2.1.5
linuxfoundationcontainerd2.2.0any
linuxfoundationcontainerd2.2.0any
linuxfoundationcontainerd2.2.0any
linuxfoundationcontainerd2.2.0any
linuxfoundationcontainerd2.2.0any

References 3

  • github.com https://github.com/containerd/containerd/blob/main/docs/rootless.md
    Product
  • github.com https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5
    Patch
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w
    PatchVendor Advisory

Remediation

  • github.com https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5
    Patch
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w
    PatchVendor Advisory