CVE-2024-25621

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-25621
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25621.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-25621
Aliases
Downstream
Related
Published
2025-11-06T18:36:21Z
Modified
2025-11-08T05:10:37.536601Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
containerd affected by a local privilege escalation via wide permissions on CRI directory
Details

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

Database specific 
{
    "cwe_ids": [
        "CWE-279"
    ]
}
References

Affected packages

Git / github.com/containerd/containerd

Affected ranges

Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
442cb34bda9a6a0fed82a2ca7cade05c5c749582
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.29"
        }
    ]
}
Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
de55dfc0f184aa6ed19de4dc02a3a4bae3476c88
Fixed
4ac6c20c7bbf8177f29e46bbdc658fec02ffb8ad
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0-beta.0"
        },
        {
            "fixed": "2.0.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
b430e5ac3accf636cf52b0128b27bb828574cbcf
Fixed
fcd43222d6b07379a4be9786bda52438f0dd16a1
Database specific 
{
    "versions": [
        {
            "introduced": "2.1.0-beta.0"
        },
        {
            "fixed": "2.1.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
5bcf77a55038ad658c57fdecc48af54935a0d42f
Fixed
1c4457e00facac03ce1d75f7b6777a7a851e5c41
Database specific 
{
    "versions": [
        {
            "introduced": "2.2.0-beta.0"
        },
        {
            "fixed": "2.2.0"
        }
    ]
}

Affected versions

0.*

0.0.2
0.0.3
0.0.4
0.0.5

api/v1.*

api/v1.10.0
api/v1.10.0-beta.0
api/v1.10.0-beta.1
api/v1.10.0-rc.0
api/v1.6.0-beta.1
api/v1.6.0-beta.2
api/v1.6.0-beta.3
api/v1.7.19
api/v1.8.0
api/v1.8.0-rc.0
api/v1.8.0-rc.1
api/v1.8.0-rc.2
api/v1.8.0-rc.3
api/v1.8.0-rc.4
api/v1.9.0
api/v1.9.0-rc.0

v0.*

v0.1.0
v0.2.0
v0.2.3

v1.*

v1.0.0
v1.0.0-alpha0
v1.0.0-alpha1
v1.0.0-alpha2
v1.0.0-alpha3
v1.0.0-alpha4
v1.0.0-alpha5
v1.0.0-alpha6
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-rc.0
v1.1.0
v1.1.0-rc.0
v1.1.0-rc.1
v1.1.0-rc.2
v1.2.0
v1.2.0-beta.0
v1.2.0-beta.1
v1.2.0-beta.2
v1.2.0-rc.0
v1.2.0-rc.1
v1.2.0-rc.2
v1.3.0
v1.3.0-beta.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0-rc.0
v1.3.0-rc.1
v1.3.0-rc.2
v1.3.0-rc.3
v1.4.0
v1.4.0-beta.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.0-rc.0
v1.4.0-rc.1
v1.5.0
v1.5.0-beta.0
v1.5.0-beta.1
v1.5.0-beta.2
v1.5.0-beta.3
v1.5.0-beta.4
v1.5.0-rc.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.0-rc.3
v1.6.0
v1.6.0-beta.0
v1.6.0-beta.1
v1.6.0-beta.2
v1.6.0-beta.3
v1.6.0-beta.4
v1.6.0-beta.5
v1.6.0-rc.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.0-rc.4
v1.7.0
v1.7.0-beta.0
v1.7.0-beta.1
v1.7.0-beta.2
v1.7.0-beta.3
v1.7.0-beta.4
v1.7.0-rc.0
v1.7.0-rc.1
v1.7.0-rc.2
v1.7.0-rc.3
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.19
v1.7.2
v1.7.20
v1.7.21
v1.7.22
v1.7.23
v1.7.24
v1.7.25
v1.7.26
v1.7.27
v1.7.28
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9

v2.*

v2.0.0
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-rc.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.3
v2.0.0-rc.4
v2.0.0-rc.5
v2.0.0-rc.6
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.0-beta.0
v2.1.0-beta.1
v2.1.0-rc.0
v2.1.0-rc.1
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.2.0-beta.0
v2.2.0-beta.1
v2.2.0-beta.2
v2.2.0-rc.0
v2.2.0-rc.1