p PatchFirst

CVE-2024-40635

CVE-2024-40635 · containerd has an integer overflow in User ID handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

CVSS 4.6 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • containerd

    Versions
    • < 1.6.38: Affected
    • >= 1.7.0-beta.0, < 1.7.27: Affected
    • >= 2.0.0-beta.0, < 2.0.4: Affected

    No fix published

  • containerd Debian:12

    Versions
    • 1.6.20~ds1-1
    • 1.6.20~ds1-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.6.20~ds1-1+deb12u2

    Update to 1.6.20~ds1-1+deb12u2

  • containerd Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.7.24~ds1-6

    Update to 1.7.24~ds1-6

  • containerd Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.7.24~ds1-6

    Update to 1.7.24~ds1-6

  • containerd Ubuntu:Pro:16.04:LTS

    Versions
    • 0.2.1-0ubuntu4~16.04
    • 0.2.3-0ubuntu1~16.04
    • 0.2.5-0ubuntu1~16.04.1
    • 1.2.6-0ubuntu1~16.04.2
    • 1.2.6-0ubuntu1~16.04.3
    • 1.2.6-0ubuntu1~16.04.4
    • 1.2.6-0ubuntu1~16.04.5
    • 1.2.6-0ubuntu1~16.04.6
    • 1.2.6-0ubuntu1~16.04.6+esm1
    • 1.2.6-0ubuntu1~16.04.6+esm2
    • 1.2.6-0ubuntu1~16.04.6+esm4
    Affected ranges
    • ECOSYSTEM: < 1.2.6-0ubuntu1~16.04.6+esm5

    Update to 1.2.6-0ubuntu1~16.04.6+esm5

  • containerd Ubuntu:Pro:18.04:LTS

    Versions
    • 0.2.5-0ubuntu2
    • 1.2.6-0ubuntu1~18.04.1
    • 1.2.6-0ubuntu1~18.04.2
    • 1.3.3-0ubuntu1~18.04.1
    • 1.3.3-0ubuntu1~18.04.2
    • 1.3.3-0ubuntu1~18.04.3
    • 1.3.3-0ubuntu1~18.04.4
    • 1.4.4-0ubuntu1~18.04.2
    • 1.5.2-0ubuntu1~18.04.1
    • 1.5.2-0ubuntu1~18.04.2
    • 1.5.2-0ubuntu1~18.04.3
    • 1.5.5-0ubuntu3~18.04.1
    • 1.5.5-0ubuntu3~18.04.2
    • 1.5.9-0ubuntu1~18.04.1
    • 1.5.9-0ubuntu1~18.04.2
    • 1.6.12-0ubuntu1~18.04.1
    • 1.6.12-0ubuntu1~18.04.1+esm1
    Affected ranges
    • ECOSYSTEM: < 1.6.12-0ubuntu1~18.04.1+esm2

    Update to 1.6.12-0ubuntu1~18.04.1+esm2

  • containerd Ubuntu:20.04:LTS

    Versions
    • 1.2.10-0ubuntu1
    • 1.3.2-0ubuntu1
    • 1.3.3-0ubuntu1
    • 1.3.3-0ubuntu2
    • 1.3.3-0ubuntu2.1
    • 1.3.3-0ubuntu2.2
    • 1.3.3-0ubuntu2.3
    • 1.4.4-0ubuntu1~20.04.2
    • 1.5.2-0ubuntu1~20.04.1
    • 1.5.2-0ubuntu1~20.04.2
    • 1.5.2-0ubuntu1~20.04.3
    • 1.5.5-0ubuntu3~20.04.1
    • 1.5.5-0ubuntu3~20.04.2
    • 1.5.9-0ubuntu1~20.04.1
    • 1.5.9-0ubuntu1~20.04.4
    • 1.5.9-0ubuntu1~20.04.5
    • 1.5.9-0ubuntu1~20.04.6
    • 1.6.12-0ubuntu1~20.04.1
    • 1.6.12-0ubuntu1~20.04.3
    • 1.6.12-0ubuntu1~20.04.5
    • 1.6.12-0ubuntu1~20.04.6
    • 1.6.12-0ubuntu1~20.04.7
    Affected ranges
    • ECOSYSTEM: < 1.6.12-0ubuntu1~20.04.8

    Update to 1.6.12-0ubuntu1~20.04.8

  • containerd-app Ubuntu:20.04:LTS

    Versions
    • 1.7.2-0ubuntu1~20.04.1
    • 1.7.12-0ubuntu2~20.04.1
    • 1.7.24-0ubuntu1~20.04.1
    Affected ranges
    • ECOSYSTEM: < 1.7.24-0ubuntu1~20.04.2

    Update to 1.7.24-0ubuntu1~20.04.2

  • containerd Ubuntu:22.04:LTS

    Versions
    • 1.5.5-0ubuntu3
    • 1.5.9-0ubuntu1
    • 1.5.9-0ubuntu2
    • 1.5.9-0ubuntu3
    • 1.5.9-0ubuntu3.1
    • 1.6.12-0ubuntu1~22.04.1
    • 1.6.12-0ubuntu1~22.04.3
    • 1.6.12-0ubuntu1~22.04.5
    • 1.6.12-0ubuntu1~22.04.6
    • 1.6.12-0ubuntu1~22.04.7
    Affected ranges
    • ECOSYSTEM: < 1.6.12-0ubuntu1~22.04.8

    Update to 1.6.12-0ubuntu1~22.04.8

  • containerd-app Ubuntu:22.04:LTS

    Versions
    • 1.7.2-0ubuntu1~22.04.1
    • 1.7.12-0ubuntu2~22.04.1
    • 1.7.24-0ubuntu1~22.04.1
    Affected ranges
    • ECOSYSTEM: < 1.7.24-0ubuntu1~22.04.2

    Update to 1.7.24-0ubuntu1~22.04.2

  • containerd-app Ubuntu:24.04:LTS

    Versions
    • 1.7.2-0ubuntu2
    • 1.7.12-0ubuntu1
    • 1.7.12-0ubuntu2
    • 1.7.12-0ubuntu3
    • 1.7.12-0ubuntu4
    • 1.7.12-0ubuntu4.1
    • 1.7.19-0ubuntu1~24.04.1
    • 1.7.19+really1.7.12-0ubuntu4.2
    • 1.7.24-0ubuntu1~24.04.1
    Affected ranges
    • ECOSYSTEM: < 1.7.24-0ubuntu1~24.04.2

    Update to 1.7.24-0ubuntu1~24.04.2

  • containerd Ubuntu:Pro:24.04:LTS

    Versions
    • 1.6.20~ds1-1ubuntu2
    • 1.6.24~ds1-1ubuntu1
    • 1.6.24~ds1-1ubuntu1.1
    • 1.6.24~ds1-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: < 1.6.24~ds1-1ubuntu1.2+esm1

    Update to 1.6.24~ds1-1ubuntu1.2+esm1

  • containerd-app Ubuntu:25.10

    Affected ranges
    • ECOSYSTEM: < 2.0.2-0ubuntu2

    Update to 2.0.2-0ubuntu2

Original sources

Check your server →