CVE catalog

CVE-2024-40635

containerd vulnerability

[CVE catalog]

Severity
Medium · CVSS 4.6CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1fixed
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1fixed
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3fixed
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2fixed
Ubuntucontainerdnoble1.6.24~ds1-1ubuntu1.2+esm1fixed
Ubuntucontainerd-appnoble1.7.24-0ubuntu1~24.04.2fixed
Ubuntucontainerdnoble1.7.24-0ubuntu1~24.04.2fixed
Ubuntugolang-github-containerd-containerd-devnoble1.6.24~ds1-1ubuntu1.2+esm1fixed
Ubuntucontainerdpro1.6.20~ds1-1ubuntu2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2+esm1fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.5vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.6vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.5vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.6vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.7vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.8fixed
Ubuntucontainerd-app20.041.7.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd-app20.041.7.12-0ubuntu2~20.04.1vulnerable
Ubuntucontainerd-app20.041.7.24-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd-app20.041.7.24-0ubuntu1~20.04.2fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.3vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.5vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.6vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.7vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.8fixed
Ubuntucontainerd-app22.041.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.2fixed
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2fixed
Opensusecontainerdtumbleweed1.7.27-1.1fixed
Susecontainerdlinux micro 6.11.7.27-slfo.1.1_1.1fixed
Susecontainerdlinux micro 6.01.7.27-1.1fixed
Opensusecmctltumbleweed2.2.0-1.1fixed
Susecontainerdlinux enterprise micro 5.31.7.27-150000.123.1fixed
Susecontainerdlinux enterprise micro 5.41.7.27-150000.123.1fixed
Susecontainerdlinux enterprise micro 5.51.7.27-150000.123.1fixed
Susecontainerdlinux enterprise module for containers 15 sp61.7.27-150000.123.1fixed
Susecontainerdlinux enterprise micro 5.11.7.27-150000.123.1fixed
Susecontainerdlinux enterprise micro 5.21.7.27-150000.123.1fixed
Opensusecontainerdleap 15.61.7.27-150000.123.1fixed
Ubuntucontainerdpro1.6.20~ds1-1ubuntu2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.1vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2vulnerable
Ubuntucontainerdpro1.6.24~ds1-1ubuntu1.2+esm1fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.5vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.6vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.5vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.6vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.7vulnerable
Ubuntucontainerd20.041.6.12-0ubuntu1~20.04.8fixed
Ubuntucontainerd-app20.041.7.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd-app20.041.7.12-0ubuntu2~20.04.1vulnerable
Ubuntucontainerd-app20.041.7.24-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd-app20.041.7.24-0ubuntu1~20.04.2fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.3vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.5vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.6vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.7vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.8fixed
Ubuntucontainerd-app22.041.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-app22.041.7.24-0ubuntu1~22.04.2fixed
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2fixed
Ubuntucontainerd-app25.102.0.2-0ubuntu2fixed
Susecontainerdlinux enterprise server ltss extended security 12 sp51.7.27-16.100.1fixed
Opensusegovulncheck-vulndbtumbleweed0.0.20250318T181448-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid1.7.24~ds1-6not yet assignedNot reported[1100806]
Debiancontainerdsourceforky1.7.24~ds1-6not yet assignedNot reported[1100806]
Debiancontainerdsourcetrixie1.7.24~ds1-6not yet assignedNot reported[1100806]
Debiancontainerdsourcebookworm1.6.20~ds1-1+deb12u2not yet assignedNot reported[1100806]
Ubuntucontainerddebnoble1.6.24~ds1-1ubuntu1.2+esm1Not reportedNot reportedNot reported
Ubuntucontainerd-appdebnoble1.7.24-0ubuntu1~24.04.2Not reportedNot reportedNot reported
Ubuntucontainerddebnoble1.7.24-0ubuntu1~24.04.2Not reportedNot reportedNot reported
Ubuntugolang-github-containerd-containerd-devdebnoble1.6.24~ds1-1ubuntu1.2+esm1Not reportedNot reportedNot reported
Ubuntucontainerddebpro1.6.24~ds1-1ubuntu1.2+esm1Not reportedUSN-7374-1Not reported
Ubuntucontainerddeb20.041.6.12-0ubuntu1~20.04.8Not reportedUSN-7374-1Not reported
Ubuntucontainerd-appdeb20.041.7.24-0ubuntu1~20.04.2Not reportedUSN-7374-1Not reported
Ubuntucontainerddeb22.041.6.12-0ubuntu1~22.04.8Not reportedUSN-7374-1Not reported
Ubuntucontainerd-appdeb22.041.7.24-0ubuntu1~22.04.2Not reportedUSN-7374-1Not reported
Ubuntucontainerd-appdeb24.041.7.24-0ubuntu1~24.04.2Not reportedUSN-7374-1Not reported
Opensusecontainerdrpmtumbleweed1.7.27-1.1Not reportedOPENSUSE-SU-2025:15169-1Not reported
Susecontainerdrpmlinux micro 6.11.7.27-slfo.1.1_1.1Not reportedSUSE-SU-2025:20459-1Not reported
Susecontainerdrpmlinux micro 6.01.7.27-1.1Not reportedSUSE-SU-2025:20216-1Not reported
Opensusecmctlrpmtumbleweed2.2.0-1.1Not reportedOPENSUSE-SU-2025:15039-1Not reported
Susecontainerdrpmlinux enterprise micro 5.31.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Susecontainerdrpmlinux enterprise micro 5.41.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Susecontainerdrpmlinux enterprise micro 5.51.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp61.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Susecontainerdrpmlinux enterprise micro 5.11.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Susecontainerdrpmlinux enterprise micro 5.21.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Opensusecontainerdrpmleap 15.61.7.27-150000.123.1Not reportedSUSE-SU-2025:1345-1Not reported
Ubuntucontainerddebpro1.6.24~ds1-1ubuntu1.2+esm1Not reportedUBUNTU-CVE-2024-40635Not reported
Ubuntucontainerddeb20.041.6.12-0ubuntu1~20.04.8Not reportedUBUNTU-CVE-2024-40635Not reported
Ubuntucontainerd-appdeb20.041.7.24-0ubuntu1~20.04.2Not reportedUBUNTU-CVE-2024-40635Not reported
Ubuntucontainerddeb22.041.6.12-0ubuntu1~22.04.8Not reportedUBUNTU-CVE-2024-40635Not reported
Ubuntucontainerd-appdeb22.041.7.24-0ubuntu1~22.04.2Not reportedUBUNTU-CVE-2024-40635Not reported
Ubuntucontainerd-appdeb24.041.7.24-0ubuntu1~24.04.2Not reportedUBUNTU-CVE-2024-40635Not reported
Ubuntucontainerd-appdeb25.102.0.2-0ubuntu2Not reportedUBUNTU-CVE-2024-40635Not reported
Susecontainerdrpmlinux enterprise server ltss extended security 12 sp51.7.27-16.100.1Not reportedSUSE-SU-2025:1346-1Not reported
Opensusegovulncheck-vulndbrpmtumbleweed0.0.20250318T181448-1.1Not reportedOPENSUSE-SU-2025:14910-1Not reported

[Debian bug #1100806]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [containerd]Unknown
    Details (4)
    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

  • Source package: [containerd]

    Details (4)
    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.20~ds1-1+deb12u2

      usn · containerd · debian · bookworm; usn · containerd · debian · 12

[Debian 13 (Trixie)]

  • [containerd]Unknown
    Details (4)
    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

  • Source package: [containerd]

    Details (4)
    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.7.24~ds1-6

      usn · containerd · debian · 13

[openSUSE Tumbleweed]

  • [cmctl]Unknown

    Source package: [cmctl]

    Details (1)
    • 2.5.0-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 2.2.0-1.1

      usn · cmctl · opensuse · tumbleweed

  • Source package: [cmctl]

    Details (1)
    • 2.5.0-1.4 · noarch · tumbleweed

      Unknown · Fixed: 2.2.0-1.1

      Version impact unknown

      usn · cmctl · opensuse · tumbleweed

  • Source package: [cmctl]

    Details (1)
    • 2.5.0-1.4 · noarch · tumbleweed

      Unknown · Fixed: 2.2.0-1.1

      Version impact unknown

      usn · cmctl · opensuse · tumbleweed

  • Source package: [cmctl]

    Details (1)
    • 2.5.0-1.4 · noarch · tumbleweed

      Unknown · Fixed: 2.2.0-1.1

      Version impact unknown

      usn · cmctl · opensuse · tumbleweed

  • [containerd]Unknown

    Source package: [containerd]

    Details (1)
    • 1.7.33-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.7.27-1.1

      usn · containerd · opensuse · tumbleweed

  • Source package: [containerd]

    Details (1)
    • 1.7.33-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.7.27-1.1

      Version impact unknown

      usn · containerd · opensuse · tumbleweed

  • Source package: [containerd]

    Details (1)
    • 1.7.33-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.7.27-1.1

      Version impact unknown

      usn · containerd · opensuse · tumbleweed

  • Source package: [govulncheck-vulndb]

    Details (1)
    • 0.0.20260828T144745-1.1 · noarch · tumbleweed

      Fixed · Fixed: 0.0.20250318T181448-1.1

      usn · govulncheck-vulndb · opensuse · tumbleweed

Observed:

References