CVE-2024-40635

Name
CVE-2024-40635
Description
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da
MISC https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
MISC https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
CONFIRM https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html

Match rules

CPE URI Source package Min version Max version
containerd >= 0 < 1.6.38
containerd >= 1.7.0-beta.0 < 1.7.27
containerd >= 2.0.0-beta.0 < 2.0.4
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* containerd >= None < 1.6.38
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* containerd >= 1.7.0 < 1.7.27
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* containerd >= 2.0.0 < 2.0.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
containerd edge-community 2.0.3-r1 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 2.0.3-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 2.0.2-r1 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 2.0.2-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 2.0.1-r1 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 2.0.1-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 2.0.0-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.6.18-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.6.12-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.6.6=r0 None possibly vulnerable
containerd edge-community 1.6.6-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.6.2-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.6.1-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.5.9-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.5.8-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.5.7-r0 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.5.4-r0 Jake Buchholz <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.4.4-r0 Jake Buchholz <tomalok@gmail.com> possibly vulnerable
containerd edge-community 1.4.3-r0 None possibly vulnerable
containerd edge-community 1.3.3-r0 None possibly vulnerable
containerd edge-community 1.3.1-r0 None possibly vulnerable
containerd edge-community 1.3.0-r0 None possibly vulnerable
containerd edge-community 1.2.9-r0 None possibly vulnerable
containerd edge-community 1.2.6-r0 None possibly vulnerable
containerd 3.22-community 2.0.0-r5 Jake Buchholz Göktürk <tomalok@gmail.com> possibly vulnerable
containerd 3.22-community 1.6.18-r0 None possibly vulnerable
containerd 3.22-community 1.6.12-r0 None possibly vulnerable
containerd 3.22-community 1.6.6-r0 None possibly vulnerable
containerd 3.22-community 1.6.2-r0 None possibly vulnerable
containerd 3.22-community 1.6.1-r0 None possibly vulnerable
containerd 3.22-community 1.5.9-r0 None possibly vulnerable
containerd 3.22-community 1.5.8-r0 None possibly vulnerable
containerd 3.22-community 1.5.7-r0 None possibly vulnerable
containerd 3.22-community 1.5.4-r0 None possibly vulnerable
containerd 3.22-community 1.4.4-r0 None possibly vulnerable
containerd 3.22-community 1.4.3-r0 None possibly vulnerable
containerd 3.22-community 1.3.3-r0 None possibly vulnerable
containerd 3.22-community 1.3.1-r0 None possibly vulnerable
containerd 3.22-community 1.3.0-r0 None possibly vulnerable
containerd 3.22-community 1.2.9-r0 None possibly vulnerable
containerd 3.22-community 1.2.6-r0 None possibly vulnerable