fix(vuln): CVE-2024-25621: While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

[jdesouza]

Description

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

Related issues

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

It has been fixed in 2.1.5.
GHSA-pwhc-rpq9-4c8w

Trivy currently uses the fixed version.
#9763

[jdesouza]

@knqyf263 I am using latest trivy and still getting the CVE when scanning trivy with trivy

[jdesouza]

usr/local/bin/trivy (gobinary)

Total: 4 (HIGH: 4, CRITICAL: 0)

┌─────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/containerd/containerd │ CVE-2024-25621 │ HIGH │ fixed │ v1.7.28 │ 1.7.29 │ containerd is an open-source container runtime. Versions │
│ │ │ │ │ │ │ 0.1.0 through ... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-25621 │
├─────────────────────────────────────┤ │ │ ├───────────────────┼─────────────────────┤ │
│ github.com/containerd/containerd/v2 │ │ │ │ v2.1.4 │ 2.0.7, 2.1.5, 2.2.0 │ │
│ │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
├─────────────────────────────────────┼────────────────┤ │ ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/opencontainers/selinux │ CVE-2025-52881 │ │ │ v1.12.0 │ 1.13.0 │ runc: opencontainers/selinux: container escape and denial of │
│ │ │ │ │ │ │ service due to arbitrary write... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-52881 │
├─────────────────────────────────────┼────────────────┤ │ ├───────────────────┼─────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2025-58187 │ │ │ v1.25.2 │ 1.24.9, 1.25.3 │ Due to the design of the name constraint checking algorithm, │
│ │ │ │ │ │ │ the proce... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-58187 │
└─────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────────────┘
done with scan!

[knqyf263]

The fix is in the main branch, but not yet released.

[jdesouza]

Ah ok thanks

[nikpivkin]

The fix is in the main branch, but not yet released.

The vulnerability CVE-2024-25621 is also present in the transitive package github.com/containerd/containerd version v1.7.28:

usr/local/bin/trivy (gobinary)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│             Library              │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ github.com/containerd/containerd │ CVE-2024-25621 │ HIGH     │ fixed  │ v1.7.28           │ 1.7.29        │ containerd is an open-source container runtime. Versions    │
│                                  │                │          │        │                   │               │ 0.1.0 through ...                                           │
│                                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-25621                  │
│                                  ├────────────────┼──────────┤        │                   │               ├─────────────────────────────────────────────────────────────┤
│                                  │ CVE-2025-64329 │ MEDIUM   │        │                   │               │ containerd is an open-source container runtime. Versions    │
│                                  │                │          │        │                   │               │ 1.7.28 and be ...                                           │
│                                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-64329                  │
├──────────────────────────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto              │ CVE-2025-47914 │          │        │ v0.41.0           │ 0.45.0        │ SSH Agent servers do not validate the size of messages when │
│                                  │                │          │        │                   │               │ processing...                                               │
│                                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-47914                  │
│                                  ├────────────────┤          │        │                   │               ├─────────────────────────────────────────────────────────────┤
│                                  │ CVE-2025-58181 │          │        │                   │               │ SSH servers parsing GSSAPI authentication requests do not   │
│                                  │                │          │        │                   │               │ validate the ...                                            │
│                                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-58181                  │
└──────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

[knqyf263]

The vulnerability CVE-2024-25621 is also present in the transitive package github.com/containerd/containerd version v1.7.28:

Ah, yes, I forgot to merge #9764. Merged now. Thanks.

Closing this PR.

[jdesouza]

Thanks!