CVE-2024-25621

HIGH

containerd affected by a local privilege escalation via wide permissions on CRI directory

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-25621 has a selected CVSS score of 7.3 (high).

Description

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 6, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

containerd

Browse containerd / containerd
CVE List< 1.7.29affected
>= 2.0.0-beta.0, < 2.0.7affected
>= 2.1.0-beta.0, < 2.1.5affected
>= 2.2.0-beta.0, < 2.2.0affected

github.com/containerd/containerd

Browse Go / github.com/containerd/containerd
GitHub AdvisoryBefore 1.7.29 · Fixed in 1.7.29affected

github.com/containerd/containerd/v2

Browse Go / github.com/containerd/containerd/v2
GitHub AdvisoryBefore 2.0.7 · Fixed in 2.0.7affected
2.1.0-beta.0 to < 2.1.5 · Fixed in 2.1.5affected
2.2.0-beta.0 to < 2.2.0 · Fixed in 2.2.0affected

References

5