VDB
DEBIAN-CVE-2024-40635
DEBIAN-CVE-2024-40635
PUBLISHED
CVSS 7.800000190734863 HIGH
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | containerd | 0, 1.4.13~ds1-1~deb11u1, 1.4.13~ds1-1~deb11u2 |
| Debian:14 | containerd | 0, 0 |
| Debian:12 | containerd | 1.6.20~ds1-1, 1.6.20~ds1-1+deb12u1, 0 |
| Debian:13 | containerd | 0, 0 |
Exploit Intelligence
- Proof of Concept code for proving CVE-2024-40635 vulnerability (github-poc-repo)
- Proof of Concept code for proving CVE-2024-40635 vulnerability (github-poc)
- checksec.go (github-poc)
- glcve_test.go (github-poc)
- vul.go (github-poc)
- exploit.go (github-poc)
Timeline
- Mar 17, 2025 CVE Published
- Apr 28, 2026 CVE Updated