CVE-2024-40635

What it actually does

Integer overflow in UID:GID parsing allows containers configured with UID:GID values exceeding 32-bit signed max to execute as UID 0 instead of the intended high-UID non-root user.

Why it matters to the business

Environments that rely on containers running as non-root users for isolation or compliance may inadvertently grant full root privileges inside containers, increasing risk of container escapes or unauthorized host access; low exploitability and no known ransomware use reduce immediate urgency but still require prompt patching.

How an attack unfolds

An attacker supplies or tricks the system into using a container image whose configuration specifies a UID:GID larger than INT32_MAX; containerd's parsing overflows and treats the value as zero, launching the container as root. No named threat actors are associated with this flaw.

How to fix it

Upgrade containerd to version 1.6.38, 1.7.27, or 2.0.4 (commit cf158e884cfe4812a6c371b59e4ea9bc4c46e51a or later). As a temporary mitigation, restrict image imports to trusted sources and limit image import permissions to trusted users only.

How to confirm the fix worked

Confirm containerd version is at or above the fixed releases; test by launching a container with a high UID:GID and verifying the process does not run as root inside the container.

Typical attack path

1. Obtain or craft a container image whose OCI config.json sets user to a UID:GID > 2147483647
2. Ensure the image is imported or pulled by a user with image import permissions
3. Launch the container via containerd without additional UID namespace restrictions
4. Container process starts with effective UID 0 due to overflow
5. Attacker leverages root privileges inside the container for further actions

How to detect it

Review container runtime logs and image import events for launches involving high numeric UID values; inspect container config.json files for user fields exceeding 32-bit signed integer range; correlate with process listings showing unexpected root execution inside containers.

What your security team should do

• Prioritize upgrade of all containerd instances to the fixed versions within standard change windows
• Audit existing container configurations for any high-UID settings and correct them
• Enforce image signing and trusted registry policies to limit untrusted image use
• Monitor EPSS trend; reassess if score rises significantly