Github.Com Containerd Containerd vulnerabilities

CVE-2024-25621 [HIGH] CWE-279 containerd affected by a local privilege escalation via wide permissions on CRI directory containerd affected by a local privilege escalation via wide permissions on CRI directory ### Impact An overly broad default permission vulnerability was found in containerd. - `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store

CVE-2025-64329 [MEDIUM] CWE-401 containerd CRI server: Host memory exhaustion through Attach goroutine leak containerd CRI server: Host memory exhaustion through Attach goroutine leak ### Impact A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. Repetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd.

CVE-2024-40635 [HIGH] CWE-190 containerd has an integer overflow in User ID handling containerd has an integer overflow in User ID handling ### Impact A bug was found in containerd where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. ### Patches This bug has

CVE-2021-21334 [MEDIUM] CWE-200 containerd environment variable leak containerd environment variable leak ## Impact Containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive informat

CVE-2023-25173 [HIGH] CWE-269 Supplementary groups are not set up properly in github.com/containerd/containerd Supplementary groups are not set up properly in github.com/containerd/containerd ### Impact A bug was found in containerd where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some

CVE-2023-25153 [MEDIUM] CWE-400 OCI image importer memory exhaustion in github.com/containerd/containerd OCI image importer memory exhaustion in github.com/containerd/containerd ### Impact When importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. ### Patches This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versio

CVE-2022-23471 [MEDIUM] CWE-400 containerd CRI stream server vulnerable to host memory exhaustion via terminal containerd CRI stream server vulnerable to host memory exhaustion via terminal ### Impact A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will

CVE-2022-31030 [MEDIUM] CWE-400 containerd CRI plugin: Host memory exhaustion through ExecSync containerd CRI plugin: Host memory exhaustion through ExecSync ### Impact A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and cr

CVE-2022-23648 [HIGH] CWE-200 containerd CRI plugin: Insecure handling of image volumes containerd CRI plugin: Insecure handling of image volumes ### Impact A bug was found in containerd where containers launched through containerd’s CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and e

CVE-2020-15157 [MEDIUM] CWE-522 containerd v1.2.x can be coerced into leaking credentials during image pull containerd v1.2.x can be coerced into leaking credentials during image pull ## Impact If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the

CVE-2021-43816 [HIGH] CWE-281 Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux ### Impact Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bi

CVE-2021-41103 [MEDIUM] CWE-22 Insufficiently restricted permissions on plugin directories Insufficiently restricted permissions on plugin directories ### Impact A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users

CVE-2021-32760 [MEDIUM] CWE-668 Archive package allows chmod of file outside of unpack target directory Archive package allows chmod of file outside of unpack target directory ## Impact A bug was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like

CVE-2020-15257 [MEDIUM] CWE-669 containerd-shim API Exposed to Host Network Containers containerd-shim API Exposed to Host Network Containers ## Impact Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new pro