CVE catalog

CVE-2024-25621

containerd vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1fixed
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1fixed
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3fixed
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2fixed
Ubuntucontainerdnoble1.6.24~ds1-1ubuntu1.3+esm2fixed
Ubuntucontainerd-appnoble1.7.28-0ubuntu1~24.04.2fixed
Ubuntucontainerdnoble1.7.28-0ubuntu1~24.04.2fixed
Ubuntugolang-github-containerd-containerd-devnoble1.6.24~ds1-1ubuntu1.3+esm2fixed
Opensusegovulncheck-vulndbleap 16.00.0.20260723T184607-160000.1.1fixed
Opensusecontainerdleap 16.01.7.33-160000.1.1fixed
Ubuntucontainerdpro1.6.20~ds1-1ubuntu2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2+esm1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.3vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.3+esm1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.3+esm2fixed
Ubuntucontainerd-apppro1.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.24-0ubuntu1~22.04.2vulnerable
Ubuntucontainerd-apppro1.7.27-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.28-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.28-0ubuntu1~22.04.1+esm1fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.3vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.5vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.6vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.7vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.8vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.9vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.10fixed
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.041.7.27-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.2fixed
Ubuntucontainerd25.101.7.24~ds1-5ubuntu1vulnerable
Ubuntucontainerd25.101.7.24~ds1-6ubuntu1vulnerable
Ubuntucontainerd25.101.7.24~ds1-8ubuntu1vulnerable
Ubuntucontainerd25.101.7.24~ds1-8ubuntu1.1fixed
Ubuntucontainerd-app25.102.0.2-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.0.5-0ubuntu1vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3.1fixed
Susecontainerdlinux micro 6.11.7.29-slfo.1.1_1.1fixed
Susecontainerdlinux micro 6.01.7.29-1.1fixed
Susecontainerdlinux enterprise server 12 sp5-ltss1.7.29-16.105.1fixed
Susecontainerdlinux enterprise server ltss extended security 12 sp51.7.29-16.105.1fixed
Ubuntucontainerdpro1.6.20~ds1-1ubuntu2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2+esm1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.3vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.3+esm1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.3+esm2fixed
Ubuntucontainerd-apppro1.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.24-0ubuntu1~22.04.2vulnerable
Ubuntucontainerd-apppro1.7.27-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.28-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.28-0ubuntu1~22.04.1+esm1fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.3vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.5vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.6vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.7vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.8vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.9vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.10fixed
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.041.7.27-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.2fixed
Ubuntucontainerd25.101.7.24~ds1-5ubuntu1vulnerable
Ubuntucontainerd25.101.7.24~ds1-6ubuntu1vulnerable
Ubuntucontainerd25.101.7.24~ds1-8ubuntu1vulnerable
Ubuntucontainerd25.101.7.24~ds1-8ubuntu1.1fixed
Ubuntucontainerd-app25.102.0.2-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.0.5-0ubuntu1vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu2vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app25.102.1.3-0ubuntu3.1fixed
Susecontainerdlinux enterprise micro 5.31.7.29-150000.128.1fixed
Susecontainerdlinux enterprise micro 5.41.7.29-150000.128.1fixed
Susecontainerdlinux enterprise micro 5.51.7.29-150000.128.1fixed
Susecontainerdlinux enterprise module for basesystem 15 sp71.7.29-150000.128.1fixed
Susecontainerdlinux enterprise module for containers 15 sp61.7.29-150000.128.1fixed
Susecontainerdlinux enterprise module for containers 15 sp71.7.29-150000.128.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp3-ltss1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp4-espos1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp4-ltss1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp5-espos1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise high performance computing 15 sp5-ltss1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise server 15 sp3-ltss1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise server 15 sp4-ltss1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise server 15 sp5-ltss1.7.29-150000.128.1fixed
Susecontainerdlinux enterprise server for sap applications 15 sp31.7.29-150000.128.1fixed
Susecontainerdlinux enterprise server for sap applications 15 sp41.7.29-150000.128.1fixed
Susecontainerdlinux enterprise server for sap applications 15 sp51.7.29-150000.128.1fixed
Susecontainerdlinux enterprise micro 5.21.7.29-150000.128.1fixed
Susecontainerdenterprise storage 7.11.7.29-150000.128.1fixed
Opensusecontainerdleap 15.61.7.29-150000.128.1fixed
Opensusecontainerdtumbleweed1.7.29-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid1.7.24~ds1-9not yet assignedNot reported[1120285]
Debiancontainerdsourceforky1.7.24~ds1-9not yet assignedNot reported[1120285]
Debiancontainerdsourcetrixie1.7.24~ds1-6+deb13u1not yet assignedNot reported[1120285]
Debiancontainerdsourcebookworm1.6.20~ds1-1+deb12u2not yet assignedNot reported[1120285]
Ubuntucontainerddebnoble1.6.24~ds1-1ubuntu1.3+esm2Not reportedNot reportedNot reported
Ubuntucontainerd-appdebnoble1.7.28-0ubuntu1~24.04.2Not reportedNot reportedNot reported
Ubuntucontainerddebnoble1.7.28-0ubuntu1~24.04.2Not reportedNot reportedNot reported
Ubuntugolang-github-containerd-containerd-devdebnoble1.6.24~ds1-1ubuntu1.3+esm2Not reportedNot reportedNot reported
Opensusegovulncheck-vulndbrpmleap 16.00.0.20260723T184607-160000.1.1Not reportedOPENSUSE-SU-2026:21483-1Not reported
Opensusecontainerdrpmleap 16.01.7.33-160000.1.1Not reportedOPENSUSE-SU-2026:21213-1Not reported
Ubuntucontainerddebpro1.6.24~ds1-1ubuntu1.3+esm2Not reportedUSN-7983-1Not reported
Ubuntucontainerd-appdebpro1.7.28-0ubuntu1~22.04.1+esm1Not reportedUSN-7983-1Not reported
Ubuntucontainerddeb22.041.6.12-0ubuntu1~22.04.10Not reportedUSN-7983-1Not reported
Ubuntucontainerd-appdeb24.041.7.28-0ubuntu1~24.04.2Not reportedUSN-7983-1Not reported
Ubuntucontainerddeb25.101.7.24~ds1-8ubuntu1.1Not reportedUSN-7983-1Not reported
Ubuntucontainerd-appdeb25.102.1.3-0ubuntu3.1Not reportedUSN-7983-1Not reported
Susecontainerdrpmlinux micro 6.11.7.29-slfo.1.1_1.1Not reportedSUSE-SU-2025:21057-1Not reported
Susecontainerdrpmlinux micro 6.01.7.29-1.1Not reportedSUSE-SU-2025:21042-1Not reported
Susecontainerdrpmlinux enterprise server 12 sp5-ltss1.7.29-16.105.1Not reportedSUSE-SU-2025:4072-1Not reported
Susecontainerdrpmlinux enterprise server ltss extended security 12 sp51.7.29-16.105.1Not reportedSUSE-SU-2025:4072-1Not reported
Ubuntucontainerddebpro1.6.24~ds1-1ubuntu1.3+esm2Not reportedUBUNTU-CVE-2024-25621Not reported
Ubuntucontainerd-appdebpro1.7.28-0ubuntu1~22.04.1+esm1Not reportedUBUNTU-CVE-2024-25621Not reported
Ubuntucontainerddeb22.041.6.12-0ubuntu1~22.04.10Not reportedUBUNTU-CVE-2024-25621Not reported
Ubuntucontainerd-appdeb24.041.7.28-0ubuntu1~24.04.2Not reportedUBUNTU-CVE-2024-25621Not reported
Ubuntucontainerddeb25.101.7.24~ds1-8ubuntu1.1Not reportedUBUNTU-CVE-2024-25621Not reported
Ubuntucontainerd-appdeb25.102.1.3-0ubuntu3.1Not reportedUBUNTU-CVE-2024-25621Not reported
Susecontainerdrpmlinux enterprise micro 5.31.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise micro 5.41.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise micro 5.51.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise module for basesystem 15 sp71.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp61.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp71.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp3-ltss1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp4-espos1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp4-ltss1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp5-espos1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp5-ltss1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp3-ltss1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp4-ltss1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp5-ltss1.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 15 sp31.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 15 sp41.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 15 sp51.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmlinux enterprise micro 5.21.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Susecontainerdrpmenterprise storage 7.11.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Opensusecontainerdrpmleap 15.61.7.29-150000.128.1Not reportedSUSE-SU-2025:4288-1Not reported
Opensusecontainerdrpmtumbleweed1.7.29-1.1Not reportedOPENSUSE-SU-2025:15726-1Not reported

[Debian bug #1120285]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [containerd]Unknown
    Details (4)
    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

  • Source package: [containerd]

    Details (4)
    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

[Debian 13 (Trixie)]

  • [containerd]Unknown
    Details (4)
    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

  • Source package: [containerd]

    Details (4)
    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6+deb13u1

      usn · containerd · debian · 13

[openSUSE Tumbleweed]

  • [containerd]Unknown

    Source package: [containerd]

    Details (1)
    • 1.7.33-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.7.29-1.1

      usn · containerd · opensuse · tumbleweed

  • Source package: [containerd]

    Details (1)
    • 1.7.33-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.29-1.1

      Version impact unknown

      usn · containerd · opensuse · tumbleweed

  • Source package: [containerd]

    Details (1)
    • 1.7.33-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.7.29-1.1

      Version impact unknown

      usn · containerd · opensuse · tumbleweed

Observed:

References