VDB
RHSA-2025:23428
RHSA-2025:23428
PUBLISHED
CVSS 7.699999809265137 HIGH
A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1d0d5fe8682b94e95e56d38083c28a3acbe359257922b9557b6ef5c0cb065e43_amd64 as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1d0d5fe8682b94e95e56d38083c28a3acbe359257922b9557b6ef5c0cb065e43_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:67f7694d2ad6a891ddc005df6c49d4dd0f496ee9f89f28ff21af4bdba74dbaeb_arm64 as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:67f7694d2ad6a891ddc005df6c49d4dd0f496ee9f89f28ff21af4bdba74dbaeb_arm64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:87f5ce87383392ca51522fe04bbef7ecdba1070b1a55a80d893ba8143e029664_ppc64le as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:87f5ce87383392ca51522fe04bbef7ecdba1070b1a55a80d893ba8143e029664_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ad0bef3510f1a50bdd0eabb9044c3240c3dcc63e4cb32ee948d291a4571f4373_s390x as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ad0bef3510f1a50bdd0eabb9044c3240c3dcc63e4cb32ee948d291a4571f4373_s390x, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:495889e652f44420a47899e456d7bbf1b1e9a4eecf026550c860ac45b7fa2d7d_s390x as a component of Multicluster Global Hub 1.5.4 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8e65ccadd704d3324991a931f5dcc99097c1b9918cbf7fbe8c9b558da58dff6e_ppc64le as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8e65ccadd704d3324991a931f5dcc99097c1b9918cbf7fbe8c9b558da58dff6e_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:30d35cb3567dce38efb9800c97177981d5402baa50b435c9fc17f9d39b150705_amd64 as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:30d35cb3567dce38efb9800c97177981d5402baa50b435c9fc17f9d39b150705_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:69cb8f8c4added49195f69dc12da5d3a20f08e66513c45a07b8231fe79a9ccd0_ppc64le as a component of Multicluster Global Hub 1.5.4 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:61b1b737c3715c51509817f89aba789e30a4cb0e1ef0ad18e82cc3ee62422e94_s390x as a component of Multicluster Global Hub 1.5.4 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:f7cd7119f566c04f45b02e64ed34e89b39eaa77b6321ba627ac7ff132ed68a10_ppc64le as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:f7cd7119f566c04f45b02e64ed34e89b39eaa77b6321ba627ac7ff132ed68a10_ppc64le |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:90ced4a8d261d1956466cfde2c66fbb01a3902c4bba9242ec043eac10f727cc2_arm64 as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:90ced4a8d261d1956466cfde2c66fbb01a3902c4bba9242ec043eac10f727cc2_arm64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8eb9c20cc10dca52fb053723208b4dec03a4e98efab7a72cfcf7ea8a1bc4032_amd64 as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8eb9c20cc10dca52fb053723208b4dec03a4e98efab7a72cfcf7ea8a1bc4032_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02d64a5e1254f66b6daae1188688d5289acb7832819005de439285ba1dc68f20_amd64 as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02d64a5e1254f66b6daae1188688d5289acb7832819005de439285ba1dc68f20_amd64 |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bfc0b9e987ad9ed150b0f31046f37ab13c5b54a4d8bc23e8609329194ec5376e_arm64 as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bfc0b9e987ad9ed150b0f31046f37ab13c5b54a4d8bc23e8609329194ec5376e_arm64 |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7a68a55335de933f652c75b80d4f246a72508b958d5d5f36769337af94a0eb9b_ppc64le as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7a68a55335de933f652c75b80d4f246a72508b958d5d5f36769337af94a0eb9b_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d881c0e6fb73ef46d1e7622723172645fa7b05a3afb8a1a6b7bec221bbf48884_amd64 as a component of Multicluster Global Hub 1.5.4 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d881c0e6fb73ef46d1e7622723172645fa7b05a3afb8a1a6b7bec221bbf48884_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:076468826a7c34dbd8c5ff8dff493022e4f509e271c5a84f19c5de3e8ff0f915_s390x as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:076468826a7c34dbd8c5ff8dff493022e4f509e271c5a84f19c5de3e8ff0f915_s390x |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cce25ed95c206ba67c143655e5a7774e2a60b450895db8e46bd808741d517250_s390x as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cce25ed95c206ba67c143655e5a7774e2a60b450895db8e46bd808741d517250_s390x |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:16e4186db10c7459608038d08fb6536d43763d74e18051231b792c2225807fb1_arm64 as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:16e4186db10c7459608038d08fb6536d43763d74e18051231b792c2225807fb1_arm64 |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7cd69508a66f01778c6086d8db3a384562e76d2650bdae1c6b55dc0bc477c9a2_amd64 as a component of Multicluster Global Hub 1.5.4 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7cd69508a66f01778c6086d8db3a384562e76d2650bdae1c6b55dc0bc477c9a2_amd64 |
…and 1 more
Timeline
- Dec 17, 2025 CVE Published
- May 13, 2026 Security Advisory
- May 14, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2413190 issue
- https://www.cve.org/CVERecord?id=CVE-2024-25621 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25621 advisory
- https://github.com/containerd/containerd/blob/main/docs/rootless.md advisory
- https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w advisory
- https://access.redhat.com/errata/RHSA-2025:23428 advisory
- https://access.redhat.com/security/cve/CVE-2024-25621 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23428.json advisory
- https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5 advisory