CVE-2024-40635Medium· 4.6▾ TwilightPoC availablecontainerd has an integer overflow in User ID handling
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 25.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
1 GitHub repo (last check)
A bug was found in containerd where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Ensure that only trusted images are used and that only trusted users have permissions to import images.
The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.
If you have any questions or comments about this advisory:
To report a security issue in containerd:
github.com/containerd/containerd/v2 < 2.0.4github.com/containerd/containerd >= 1.7.0-beta.0, < 1.7.27github.com/containerd/containerd < 1.6.38Upgrade to a patched release:
github.com/containerd/containerd/v2 2.0.4github.com/containerd/containerd 1.7.27github.com/containerd/containerd 1.6.38Connected by shared product, vendor, weakness, or advisory.
GHSA-7ww5-4wqc-m92cMediumcontainerd allows RAPL to be accessible to a container
CVE-2020-15157Medium· 6.1containerd v1.2.x can be coerced into leaking credentials during image pull
GHSA-5j5w-g665-5m35Low· 3.0Ambiguous OCI manifest parsing
CVE-2022-31030Medium· 5.5containerd CRI plugin: Host memory exhaustion through ExecSync
CVE-2022-23471Medium· 5.7containerd CRI stream server vulnerable to host memory exhaustion via terminal
CVE-2023-25153Medium· 5.5OCI image importer memory exhaustion in github.com/containerd/containerd