CVE-2024-25621
High · 7.3containerd affected by a local privilege escalation via wide permissions on CRI directory
CVSS
7.3
EPSS
0.2%
Published
Nov 6, 2025
CISA due date
—
The record
An overly broad default permission vulnerability was found in containerd. - `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store - `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700 - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host. - `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700 The directory paths may differ depending on the daemon configuration. When the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/containerd/containerd | 0 | 1.7.29 |
| Go | github.com/containerd/containerd/v2 | 0 | 2.0.7 |
| Go | github.com/containerd/containerd/v2 | 2.1.0-beta.0 | 2.1.5 |
| Go | github.com/containerd/containerd/v2 | 2.2.0-beta.0 | 2.2.0 |
| Chainguard | amazon-ecs-agent-fips | 0 | 1.100.1-r2 |
| Chainguard | apm-server-7.17 | 0 | 7.17.29-r5 |
| Chainguard | apm-server-7.17-compat | 0 | 7.17.29-r5 |
| Chainguard | apm-server-fips-7.17 | 0 | 7.17.29-r5 |
| Chainguard | apm-server-fips-7.17-compat | 0 | 7.17.29-r5 |
| Chainguard | auditbeat-7 | 0 | 7.17.29-r5 |
| Chainguard | auditbeat-7-oci-entrypoint | 0 | 7.17.29-r5 |
| Chainguard | auditbeat-fips-7 | 0 | 7.17.29-r6 |
| Chainguard | beats-7 | 0 | 7.17.29-r5 |
| Chainguard | beats-fips-7 | 0 | 7.17.29-r6 |
| Chainguard | buildctl | 0 | 0.25.2-r2 |
| Chainguard | buildkitd | 0 | 0.25.2-r2 |
| Chainguard | cert-manager-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-acmesolver | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-cainjector | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-controller | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-webhook | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-1.12-bitnami-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-1.12-iamguarded-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-fips-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-1.12-bitnami-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-1.12-iamguarded-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-fips-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-cmctl | 0 | 2.3.0-r6 |
| Chainguard | cert-manager-cmctl-fips | 0 | 2.3.0-r6 |
| Chainguard | cert-manager-controller-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-controller-1.12-bitnami-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-controller-1.12-iamguarded-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-controller-fips-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-acmesolver | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-cainjector | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-cmctl | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-controller | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-webhook | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-1.12-bitnami-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-1.12-iamguarded-compat | 0 | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-fips-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cg | 0 | 0.2.174-r0 |
| Chainguard | chainctl | 0 | 0.2.175-r0 |
| Chainguard | chartmuseum | 0 | 0.16.3-r9 |
| Chainguard | chartmuseum-fips | 0 | 0.16.3-r7 |
| Chainguard | cilium-cli | 0 | 0.18.8-r1 |
| Chainguard | cloudbeat | 0 | 9.2.1-r0 |
| Chainguard | cloudbeat-8.17 | 0 | 8.17.10-r3 |
| Chainguard | cloudbeat-8.18 | 0 | 8.18.8-r3 |
| Chainguard | cloudbeat-8.19 | 0 | 8.19.6-r2 |
| Chainguard | cloudbeat-9.0 | 0 | 9.0.8-r3 |
| Chainguard | cloudbeat-9.1 | 0 | 9.1.6-r2 |
| Chainguard | cloudbeat-fips-8.17 | 0 | 8.17.10-r4 |
| Chainguard | cloudbeat-fips-8.18 | 0 | 8.18.8-r3 |
| Chainguard | cloudbeat-fips-8.19 | 0 | 8.19.6-r2 |
| Chainguard | cloudbeat-fips-9.0 | 0 | 9.0.8-r3 |
| Chainguard | cloudbeat-fips-9.1 | 0 | 9.1.6-r2 |
| Chainguard | cloudbeat-fips-9.2 | 0 | 9.2.0-r2 |
| Chainguard | cluster-api-helm-controller | 0 | 0.4.1-r2 |
| Chainguard | cluster-api-helm-controller-compat | 0 | 0.4.1-r2 |
| Chainguard | cluster-api-helm-controller-fips | 0 | 0.4.1-r2 |
| Chainguard | cluster-api-helm-controller-fips-compat | 0 | 0.4.1-r2 |
| Chainguard | cmctl-1.12 | 0 | 1.12.17-r10 |
| Chainguard | cmctl-1.12-fips | 0 | 1.12.17-r10 |
| Chainguard | cmctl-fips-1.12 | 0 | 1.12.17-r10 |
| Chainguard | consul-k8s-1.1 | 0 | 1.1.18-r20 |
| Chainguard | consul-k8s-1.1-cli | 0 | 1.1.18-r20 |
| Chainguard | consul-k8s-1.3 | 0 | 1.3.9-r21 |
| Chainguard | consul-k8s-1.3-cli | 0 | 1.3.9-r21 |
| Chainguard | consul-k8s-1.4 | 0 | 1.4.10-r8 |
| Chainguard | consul-k8s-1.4-cli | 0 | 1.4.10-r8 |
| Chainguard | consul-k8s-1.5 | 0 | 1.5.9-r7 |
| Chainguard | consul-k8s-1.5-cli | 0 | 1.5.9-r7 |
| Chainguard | consul-k8s-1.6 | 0 | 1.6.10-r2 |
| Chainguard | consul-k8s-1.6-cli | 0 | 1.6.10-r2 |
| Chainguard | consul-k8s-1.7 | 0 | 1.7.7-r1 |
| Chainguard | consul-k8s-1.7-cli | 0 | 1.7.7-r1 |
| Chainguard | consul-k8s-fips-1.1 | 0 | 1.1.18-r18 |
| Chainguard | consul-k8s-fips-1.1-cli | 0 | 1.1.18-r18 |
| Chainguard | consul-k8s-fips-1.3 | 0 | 1.3.9-r19 |
| Chainguard | consul-k8s-fips-1.3-cli | 0 | 1.3.9-r19 |
| Chainguard | consul-k8s-fips-1.4 | 0 | 1.4.10-r7 |
| Chainguard | consul-k8s-fips-1.4-cli | 0 | 1.4.10-r7 |
| Chainguard | consul-k8s-fips-1.5 | 0 | 1.5.9-r7 |
| Chainguard | consul-k8s-fips-1.5-cli | 0 | 1.5.9-r7 |
| Chainguard | consul-k8s-fips-1.6 | 0 | 1.6.10-r2 |
| Chainguard | consul-k8s-fips-1.6-cli | 0 | 1.6.10-r2 |
| Chainguard | consul-k8s-fips-1.7 | 0 | 1.7.7-r1 |
| Chainguard | consul-k8s-fips-1.7-cli | 0 | 1.7.7-r1 |
| Chainguard | containerd-1 | 0 | 1.7.29-r0 |
| Chainguard | containerd-shim-runc-v2-1 | 0 | 1.7.29-r1 |
| Chainguard | containerd-stress-1 | 0 | 1.7.29-r1 |
| Chainguard | ctr-1 | 0 | 1.7.29-r0 |
| Chainguard | dagger | 0 | 0.19.6-r0 |
| Chainguard | datadog-agent | 0 | 7.72.1-r0 |
| Chainguard | datadog-agent-7.71 | 0 | 7.71.2-r6 |
| Chainguard | datadog-agent-7.71-core-integrations | 0 | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-fakeintake | 0 | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-jmx | 0 | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-oci-compat | 0 | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-s6-overlay | 0 | 7.71.2-r5 |
| Chainguard | datadog-agent-fips | 0 | 7.72.1-r0 |
| Chainguard | datadog-agent-fips-7.71 | 0 | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 0 | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-fakeintake | 0 | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-jmx | 0 | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-oci-compat | 0 | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-s6-overlay | 0 | 7.71.2-r4 |
| Chainguard | datadog-cluster-agent-7.71 | 0 | 7.71.2-r5 |
| Chainguard | datadog-cluster-agent-7.71-oci-compat | 0 | 7.71.2-r5 |
| Chainguard | datadog-cluster-agent-fips-7.71 | 0 | 7.71.2-r4 |
| Chainguard | datadog-cluster-agent-fips-7.71-oci-compat | 0 | 7.71.2-r4 |
| Chainguard | docker-cli-buildx | 0 | 0.29.1-r2 |
| Chainguard | docker-cli-buildx-fips | 0 | 0.29.1-r2 |
| Chainguard | docker-compose | 0 | 2.40.3-r1 |
| Chainguard | docker-credential-cgr | 0 | 0.2.175-r0 |
| Chainguard | dockerd | 0 | 28.5.2-r3 |
| Chainguard | dogstatsd | 0 | 7.72.1-r0 |
| Chainguard | dogstatsd-7.71 | 0 | 7.71.2-r5 |
| Chainguard | eksctl | 0 | 0.216.0-r1 |
| Chainguard | envoy-gateway | 0 | 1.5.4-r1 |
| Chainguard | envoy-gateway-compat | 0 | 1.5.4-r1 |
| Chainguard | envoy-gateway-egctl | 0 | 1.5.4-r1 |
| Chainguard | falco-dev | 0 | 0.42.0-r0 |
| Chainguard | falco-no-driver | 0 | 0.43.0-r0 |
| Chainguard | falco-plugin-container | 0 | 0.42.0-r2 |
| Chainguard | falco-src | 0 | 0.42.0-r0 |
| Chainguard | filebeat-7 | 0 | 7.17.29-r5 |
| Chainguard | filebeat-7-oci-entrypoint | 0 | 7.17.29-r5 |
| Chainguard | filebeat-fips-7 | 0 | 7.17.29-r6 |
| Chainguard | flux-helm-controller | 0 | 1.4.3-r1 |
| Chainguard | flux-helm-controller-bitnami-compat | 0 | 1.4.3-r1 |
| Chainguard | flux-helm-controller-iamguarded-compat | 0 | 1.4.3-r1 |
| Chainguard | flux-source-controller | 0 | 1.7.3-r1 |
| Chainguard | flux-source-controller-bitnami-compat | 0 | 1.7.3-r1 |
| Chainguard | flux-source-controller-fips | 0 | 1.7.3-r2 |
| Chainguard | flux-source-controller-fips-iamguarded-compat | 0 | 1.7.3-r2 |
| Chainguard | flux-source-controller-iamguarded-compat | 0 | 1.7.3-r1 |
| Chainguard | fluxcd-source-controller-bitnami-compat | 0 | 1.7.3-r1 |
| Chainguard | fuse-overlayfs-snapshotter | 0 | 2.1.7-r0 |
| Chainguard | gatekeeper-3.18 | 0 | 3.18.3-r11 |
| Chainguard | gatekeeper-3.18-compat | 0 | 3.18.3-r11 |
| Chainguard | gatekeeper-3.18-crds | 0 | 3.18.3-r11 |
| Chainguard | gatekeeper-3.18-crds-compat | 0 | 3.18.3-r11 |
| Chainguard | gatekeeper-3.18-gator | 0 | 3.18.3-r11 |
| Chainguard | gatekeeper-3.19 | 0 | 3.19.3-r8 |
| Chainguard | gatekeeper-3.19-compat | 0 | 3.19.3-r8 |
| Chainguard | gatekeeper-3.19-crds | 0 | 3.19.3-r8 |
| Chainguard | gatekeeper-3.19-crds-compat | 0 | 3.19.3-r8 |
| Chainguard | gatekeeper-3.19-gator | 0 | 3.19.3-r8 |
| Chainguard | gatekeeper-3.20 | 0 | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-compat | 0 | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-crds | 0 | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-crds-compat | 0 | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-gator | 0 | 3.20.1-r3 |
| Chainguard | gem-check | 0 | 0.0.32-r1 |
| Chainguard | gitlab-operator | 0 | 2.5.1-r1 |
| Chainguard | gitlab-operator-charts | 0 | 2.5.1-r1 |
| Chainguard | gitlab-operator-compat | 0 | 2.5.1-r1 |
| Chainguard | gitlab-operator-fips | 0 | 2.5.1-r1 |
| Chainguard | gitlab-rails-ce-18.1 | 0 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-18.3 | 0 | 18.3.5-r1 |
| Chainguard | gitlab-rails-ce-18.4 | 0 | 18.4.3-r1 |
| Chainguard | gitlab-rails-ce-18.5 | 0 | 18.5.1-r1 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-assets-18.2 | 0 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 0 | 18.3.5-r1 |
| Chainguard | gitlab-rails-ce-assets-18.4 | 0 | 18.4.3-r1 |
| Chainguard | gitlab-rails-ce-assets-18.5 | 0 | 18.5.1-r1 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 0 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 0 | 18.3.5-r3 |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | 0 | 18.4.3-r3 |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | 0 | 18.5.1-r3 |
| Chainguard | gitlab-rails-ce-doc-18.1 | 0 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-doc-18.2 | 0 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-doc-18.3 | 0 | 18.3.5-r1 |
| Chainguard | gitlab-rails-ce-doc-18.4 | 0 | 18.4.3-r1 |
| Chainguard | gitlab-rails-ce-doc-18.5 | 0 | 18.5.1-r1 |
| Chainguard | gitlab-rails-ce-doc-fips-18.1 | 0 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-doc-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-doc-fips-18.3 | 0 | 18.3.5-r3 |
| Chainguard | gitlab-rails-ce-doc-fips-18.4 | 0 | 18.4.3-r3 |
| Chainguard | gitlab-rails-ce-doc-fips-18.5 | 0 | 18.5.1-r3 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 0 | 18.3.5-r3 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 0 | 18.4.3-r3 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 0 | 18.5.1-r3 |
| Chainguard | gogatekeeper | 0 | 4.3.0-r1 |
| Chainguard | gogatekeeper-compat | 0 | 4.3.0-r1 |
| Chainguard | google-osconfig-agent | 0 | 20251028.00-r2 |
| Chainguard | gosh | 0 | 0.0.32-r1 |
| Chainguard | grype | 0 | 0.103.0-r1 |
| Chainguard | header-check | 0 | 0.0.32-r1 |
| Chainguard | headlamp | 0 | 0.37.0-r1 |
| Chainguard | headlamp-fips | 0 | 0.37.0-r2 |
Related vulnerabilities
- CVE-2025-64329 containerd CRI server: Host memory exhaustion through Attach goroutine leak Also affects github.com/containerd/containerd
- CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. Also affects amazon-ecs-agent-fips
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects amazon-ecs-agent-fips
- CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid… Also affects amazon-ecs-agent-fips
- CVE-2025-58190 The html.Parse function in golang.org/x/net/html has an infinite parsing loop when… Also affects amazon-ecs-agent-fips
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects amazon-ecs-agent-fips
- CVE-2025-47911 The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when… Also affects amazon-ecs-agent-fips
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects amazon-ecs-agent-fips