🛡️ CVE-2024-25621 — containerd

🟠 CVSS 8.0 — High ✅ No Known Exploit CWE-279 NVD
8.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

containerd affected by a local privilege escalation via wide permissions on CRI directory

Impact

An overly broad default permission vulnerability was found in containerd.

  • /var/lib/containerd was created with the permission bits 0o711, while it should be created with 0o700
  • Allowed local users on the host to potentially access the metadata store and the content store
  • /run/containerd/io.containerd.grpc.v1.cri was created with 0o755, while it should be created with 0o700
  • Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
  • /run/containerd/io.containerd.sandbox.controller.v1.shim was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.

When the temp directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.

Patches

This bug has been fixed in the following containerd versions:

  • 2.2.0
  • 2.1.5
  • 2.0.7
  • 1.7.29

Users should update to these versions to resolve the issue.

These updates automatically change the permissions of the existing directories.

> [!NOTE]

>

> /run/containerd and /run/containerd/io.containerd.runtime.v2.task are still created with 0o711.

> This is an expected behavior for supporting userns-remapped containers.

Workarounds

The system administrator on the host can manually chmod the directories to not

have group or world accessible permisisons:

```

chmod 700 /var/lib/containerd

chmod 700 /run/containerd/io.containerd.grpc.v1.cri

chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim

```

An alternative mitigation would be to run containerd in [rootless mode](https://github.com/containerd/containerd/blob/main/docs/rootless.md).

Credits

The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).

For more information

If you have any questions or comments about this advisory:

To report a security issue in containerd:

  • [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Affected software

CVE-2024-25621 is recorded against 3 packages.

  • containerd
  • github.com/containerd/containerd
  • github.com/containerd/containerd/v2

Timeline and source

Published on 6 November 2025 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

github.com
github.com
github.com

CVE-2024-25621 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity HIGH
CVSS Score 8.0
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE CWE-279
Public Exploit ✅ No
Source NVD
Published 2025-11-06
Updated 2026-08-12
Modified 2026-06-17

Affected Packages

Software From version Fixed in
containerd — —
github.com/containerd/containerd — —
github.com/containerd/containerd/v2 — —

Site Security Check

Is containerd part of your stack?

CVE-2024-25621 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.