CVE-2024-40635
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-40635
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40635.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-40635
- Aliases
- Related
- Published
- 2025-03-17T22:15:13Z
- Modified
- 2025-03-18T18:42:17.804147Z
- Downstream
- Summary
- [none]
- Details
-
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a
UID:GIDlarger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. - References
-
- https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg
- https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da
- https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
- https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
- https://security-tracker.debian.org/tracker/CVE-2024-40635
Affected packages
Debian:11 / containerd
Package
- Name
- containerd
- Purl
- pkg:deb/debian/containerd?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.4.5~ds1-2
1.4.5~ds1-2+deb11u1
1.4.12~ds1-1~deb11u1
1.4.13~ds1-1~deb11u1
1.4.13~ds1-1~deb11u2
1.4.13~ds1-1~deb11u3
1.4.13~ds1-1~deb11u4
1.5.0~beta0~ds1-1
1.5.0~beta1~ds1-1
1.5.0~beta1~ds1-2
1.5.0~beta2~ds1-1
1.5.0~beta3~ds1-1
1.5.0~beta4~ds1-1
1.5.0~rc0~ds1-1
1.5.0~rc1~ds1-1
1.5.2~ds1-1
1.5.3~ds1-1
1.5.4~ds1-1
1.5.5~ds1-1
1.5.7~ds1-1
1.5.7~ds1-2
1.5.8~ds1-1
1.5.8~ds1-2
1.5.8~ds1-3
1.5.9~ds1-1
1.6.0~ds1-1
1.6.0~ds1-2
1.6.0~ds1-3
1.6.0~ds1-4
1.6.0~ds1-5
1.6.1~ds1-1
1.6.2~ds1-1
1.6.6~ds1-1
1.6.8~ds1-1
1.6.9~ds1-1
1.6.11~ds1-1
1.6.12~ds1-1
1.6.13~ds1-1
1.6.14~ds1-1
1.6.16~ds1-1
1.6.17~ds1-1
1.6.18~ds1-1
1.6.20~ds1-1
1.6.20~ds1-2
1.6.24~ds1-1
1.6.24~ds1-2
1.7.18~ds1-1
1.7.18~ds1-2
1.7.18~ds1-3
1.7.18~ds1-4
1.7.18~ds1-5
1.7.18~ds1-6
1.7.18~ds2-1
1.7.20~ds2-1
1.7.20~ds2-2
1.7.21~ds2-1
1.7.22~ds1-1
1.7.23~ds1-1
1.7.23~ds1-2
1.7.23~ds1-3
1.7.23~ds2-1
1.7.24~ds1-1
1.7.24~ds1-2
1.7.24~ds1-3
1.7.24~ds1-4
Debian:12 / containerd
Package
- Name
- containerd
- Purl
- pkg:deb/debian/containerd?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.6.20~ds1-1
1.6.20~ds1-1+deb12u1
1.6.20~ds1-2
1.6.24~ds1-1
1.6.24~ds1-2
1.7.18~ds1-1
1.7.18~ds1-2
1.7.18~ds1-3
1.7.18~ds1-4
1.7.18~ds1-5
1.7.18~ds1-6
1.7.18~ds2-1
1.7.20~ds2-1
1.7.20~ds2-2
1.7.21~ds2-1
1.7.22~ds1-1
1.7.23~ds1-1
1.7.23~ds1-2
1.7.23~ds1-3
1.7.23~ds2-1
1.7.24~ds1-1
1.7.24~ds1-2
1.7.24~ds1-3
1.7.24~ds1-4
Debian:13 / containerd
Package
- Name
- containerd
- Purl
- pkg:deb/debian/containerd?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.6.20~ds1-1
1.6.20~ds1-2
1.6.24~ds1-1
1.6.24~ds1-2
1.7.18~ds1-1
1.7.18~ds1-2
1.7.18~ds1-3
1.7.18~ds1-4
1.7.18~ds1-5
1.7.18~ds1-6
1.7.18~ds2-1
1.7.20~ds2-1
1.7.20~ds2-2
1.7.21~ds2-1
1.7.22~ds1-1
1.7.23~ds1-1
1.7.23~ds1-2
1.7.23~ds1-3
1.7.23~ds2-1
1.7.24~ds1-1
1.7.24~ds1-2
1.7.24~ds1-3
1.7.24~ds1-4
Git / github.com/containerd/containerd
Affected ranges
- Type
- GIT
- Repo
- https://github.com/containerd/containerd
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
Affected versions
0.*
0.0.2
0.0.3
0.0.4
0.0.5
api/v1.*
api/v1.6.0-beta.1
api/v1.6.0-beta.2
api/v1.6.0-beta.3
api/v1.7.19
api/v1.8.0
api/v1.8.0-rc.0
api/v1.8.0-rc.1
api/v1.8.0-rc.2
api/v1.8.0-rc.3
api/v1.8.0-rc.4
v0.*
v0.1.0
v0.2.0
v0.2.3
v1.*
v1.0.0
v1.0.0-alpha0
v1.0.0-alpha1
v1.0.0-alpha2
v1.0.0-alpha3
v1.0.0-alpha4
v1.0.0-alpha5
v1.0.0-alpha6
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-rc.0
v1.1.0
v1.1.0-rc.0
v1.1.0-rc.1
v1.1.0-rc.2
v1.2.0
v1.2.0-beta.0
v1.2.0-beta.1
v1.2.0-beta.2
v1.2.0-rc.0
v1.2.0-rc.1
v1.2.0-rc.2
v1.3.0
v1.3.0-beta.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0-rc.0
v1.3.0-rc.1
v1.3.0-rc.2
v1.3.0-rc.3
v1.4.0
v1.4.0-beta.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.0-rc.0
v1.4.0-rc.1
v1.5.0
v1.5.0-beta.0
v1.5.0-beta.1
v1.5.0-beta.2
v1.5.0-beta.3
v1.5.0-beta.4
v1.5.0-rc.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.0-rc.3
v1.6.0
v1.6.0-beta.0
v1.6.0-beta.1
v1.6.0-beta.2
v1.6.0-beta.3
v1.6.0-beta.4
v1.6.0-beta.5
v1.6.0-rc.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.0-rc.4
v1.6.1
v1.6.10
v1.6.11
v1.6.12
v1.6.13
v1.6.14
v1.6.15
v1.6.16
v1.6.17
v1.6.18
v1.6.19
v1.6.2
v1.6.20
v1.6.21
v1.6.22
v1.6.23
v1.6.24
v1.6.25
v1.6.26
v1.6.27
v1.6.28
v1.6.29
v1.6.3
v1.6.30
v1.6.31
v1.6.32
v1.6.33
v1.6.34
v1.6.35
v1.6.36
v1.6.37
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0
v1.7.0-beta.0
v1.7.0-beta.1
v1.7.0-beta.2
v1.7.0-beta.3
v1.7.0-beta.4
v1.7.0-rc.0
v1.7.0-rc.1
v1.7.0-rc.2
v1.7.0-rc.3
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.19
v1.7.2
v1.7.20
v1.7.21
v1.7.22
v1.7.23
v1.7.24
v1.7.25
v1.7.26
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v2.*
v2.0.0
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-rc.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.3
v2.0.0-rc.4
v2.0.0-rc.5
v2.0.0-rc.6
v2.0.1
v2.0.2
v2.0.3