{"id":"CVE-2024-25621","sourceIdentifier":"security-advisories@github.com","published":"2025-11-06T19:15:40.090","lastModified":"2026-11-08T20:10:00.187","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode."},{"lang":"es","value":"containerd es un tiempo de ejecución de contenedores de código abierto. Las versiones 0.1.0 hasta 1.7.28, 2.0.0-beta.0 hasta 2.0.6, 2.1.0-beta.0 hasta 2.1.4 y 2.2.0-beta.0 hasta 2.2.0-rc.1 tienen una vulnerabilidad de permisos predeterminados excesivamente amplia. Las rutas de directorio ’/var/lib/containerd’, ’/run/containerd/io.containerd.grpc.v1.cri’ y ’/run/containerd/io.containerd.sandbox.controller.v1.shim’ fueron creadas todas con permisos incorrectos. Este problema está solucionado en las versiones 1.7.29, 2.0.7, 2.1.5 y 2.2.0. Las soluciones provisionales incluyen actualizar los permisos del administrador del sistema para que el host pueda cambiar manualmente los permisos de los directorios para que no tengan permisos accesibles para el grupo o para todos, o ejecutar containerd en modo sin root."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"containerd","product":"containerd","versions":[{"version":"< 1.7.29","status":"affected"},{"version":">= 2.0.0-beta.0, < 2.0.7","status":"affected"},{"version":">= 2.1.0-beta.0, < 2.1.5","status":"affected"},{"version":">= 2.2.0-beta.0, < 2.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-06T19:34:44.710425Z","id":"CVE-2024-25621","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-279"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.29","matchCriteriaId":"DD786582-F4AE-41DD-B61F-BD8AF4FC1A04"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.7","matchCriteriaId":"07087EDC-9E6A-45D1-B6D2-E7F4016CD46E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.0","versionEndExcluding":"2.1.5","matchCriteriaId":"9E760B42-E25C-4780-85AE-D003D6425700"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta0:*:*:*:*:*:*","matchCriteriaId":"EEF71FE5-2286-4D94-82DD-7509CE85F1F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta1:*:*:*:*:*:*","matchCriteriaId":"3290FD7B-0A16-4968-9800-78B947EF213D"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta2:*:*:*:*:*:*","matchCriteriaId":"E4352A29-4DFC-4EBE-BE0E-97DEB76E5A30"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc0:*:*:*:*:*:*","matchCriteriaId":"57685264-6950-4CB9-ACBE-6944EB3B2C1C"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc1:*:*:*:*:*:*","matchCriteriaId":"4D640701-1D0B-41B7-83B0-79592902E6AC"}]}]}],"references":[{"url":"https://github.com/containerd/containerd/blob/main/docs/rootless.md","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}