CVE-2024-25621

Name of the Vulnerable Software and Affected Versions containerd versions 0.1.0 through 1.7.28 containerd versions 2.0.0-beta.0 through 2.0.6 containerd versions 2.1.0-beta.0 through 2.1.4 containerd versions 2.2.0-beta.0 through 2.2.0-rc.1

Description containerd is an open-source container runtime with an overly broad default permission issue. Specific directory paths, including /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim, were created with incorrect permissions.

Recommendations containerd versions 0.1.0 through 1.7.28: Update to version 1.7.29 or later. containerd versions 2.0.0-beta.0 through 2.0.6: Update to version 2.0.7 or later. containerd versions 2.1.0-beta.0 through 2.1.4: Update to version 2.1.5 or later. containerd versions 2.2.0-beta.0 through 2.2.0-rc.1: Update to version 2.2.0 or later. As a workaround, update system administrator permissions to manually adjust directory permissions to restrict group and world access. As a workaround, run containerd in rootless mode.