CVE-2024-25621

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

Scoring

Severity

HIGH

CVSS base score

7.3

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS probability

0.16%

CWE

CWE-279

Published

2025-11-06

Last modified

2026-03-13

Affected products

• containerd containerd
• containerd containerd
• containerd containerd
• containerd containerd

Weakness type

• CWE-279

Related vulnerabilities

• CVE-2026-46388 — osquery: Unprivileged users can temporarily read file carve contents
• CVE-2026-4948 — Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization
• CVE-2026-20062 — A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in...
• CVE-2025-12801 — Nfs-utils: rpc.mountd in the nfs-utils privilege escalation
• CVE-2025-14025 — Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions
• CVE-2025-36228 — Incorrect Execution-Assigned Permissions in IBM Aspera Faspex
• CVE-2025-13663 — Quartus Prime Pro Edition Installer Advisory
• CVE-2025-30001 — Apache StreamPark: Authenticated users can trigger remote command execution

Markdown version · Browse all CVEs