Introduction
An easy-to-miss permissions flaw in containerd exposed container hosts running multi-tenant workloads to privilege escalation. Local users could traverse sensitive runtime directories and potentially access them, which weakened container isolation and exposed metadata. containerd is a core open source container runtime that Kubernetes and Docker depend on, and it is widely deployed in cloud and enterprise environments. Its security directly affects a large share of the world's container infrastructure.
Technical Information
CVE-2024-25621 is a local privilege escalation vulnerability caused by incorrect directory permissions in containerd. containerd created several runtime directories with access rights that were too broad. Instead of restricting access to the owner (permission mode 0o700), affected versions created directories such as /var/lib/containerd with 0o711 and /run/containerd/io.containerd.grpc.v1.cri with 0o755. Group and world users could therefore traverse these directories, which could lead to unauthorized access to container metadata, runtime state, and potentially sensitive files.
Technical root cause:
containerd's directory creation logic did not set restrictive permissions, which violates the principle of least privilege. Any local user could traverse the directory trees, even without permission to list their contents. In Unix permission models that difference matters, because a user who cannot list a directory can still reach files inside it by name. The flaw is classified as CWE-279 (Incorrect Execution-Assigned Permissions).
The affected directories are:
/var/lib/containerd/run/containerd/io.containerd.grpc.v1.cri/run/containerd/io.containerd.sandbox.controller.v1.shim
An attacker with local access could use this to enumerate or access files whose names they knew, or chain the flaw with other vulnerabilities to escalate further.
The issue affects these containerd versions:
- 0.1.0 through 1.7.28
- 2.0.0-beta.0 through 2.0.6
- 2.1.0-beta.0 through 2.1.4
- 2.2.0-beta.0 through 2.2.0-rc.1
This post includes no code snippets. The fix only changes permission modes, and the advisories did not publish any vulnerable code.
Patch Information
The containerd developers fixed the vulnerability with a series of patches that tighten directory permissions to prevent unauthorized access.
Key changes:
The patches restrict permissions on critical directories so that only authorized users can access them.
/var/lib/containerd: previously set to0o711, which allowed broad access, and now set to0o700. Only the owner has read, write, and execute permissions, so other users can no longer reach the metadata and content stores./run/containerd/io.containerd.grpc.v1.cri: previously created with0o755, and now set to0o700. Only the owner has access, which mitigates the risk of unauthorized users interacting with the CRI (Container Runtime Interface) socket.
Implementation details:
The patches modify containerd's directory creation routines to set the correct permission bits when each directory is created. Because these directories are now created with 0o700 permissions, only the root user can reach the containerd daemon and its associated resources, which mitigates the risk of local privilege escalation.
Patch availability:
The fixes ship in these containerd versions:
- 2.2.0
- 2.1.5
- 2.0.7
- 1.7.29
Users are strongly encouraged to upgrade to one of these versions to protect their containerd installations against potential privilege escalation exploits.
Patch source: GHSA-pwhc-rpq9-4c8w
Affected Systems and Versions
- containerd versions 0.1.0 through 1.7.28
- containerd versions 2.0.0-beta.0 through 2.0.6
- containerd versions 2.1.0-beta.0 through 2.1.4
- containerd versions 2.2.0-beta.0 through 2.2.0-rc.1
Any installation running these versions with default directory permissions is vulnerable. The issue is present in every deployment environment (Kubernetes, Docker, or standalone) where the affected directories are group or world accessible.
Vendor Security History
containerd has fixed similar permission bugs before. CVE-2021-41103 involved insufficiently restricted permissions on container root directories and affected versions before 1.4.11 and 1.5.7. The project has a responsive patch process and has released fixes and advisories promptly. Still, the repeated permission issues suggest that enforcing least privilege across every code path remains a challenge for the project. containerd is a CNCF graduated project with a strong community and an active security response.
