VDB
RHSA-2025:23644
RHSA-2025:23644
PUBLISHED
CVSS 7.699999809265137 HIGH
A local privilege escalation vulnerability has been discovered in containerd. This vulnerability is the result of an overly broad default permission which allows local users on the host to potentially access the metadata store, the content store and the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:0a3b2c16808b83096039d9ed152263d6c6d1b0490d0947a528a5ea1ede4d1b93_ppc64le as a component of Multicluster Global Hub 1.4.5 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:c22a91b57ed751d0ccc80494845e490dc36041b94f810ef822edb3abba885593_amd64 as a component of Multicluster Global Hub 1.4.5 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:20a95eeeb8693c00af9c8835130c179be35f7445b6b07a68b12a8189e974524f_s390x as a component of Multicluster Global Hub 1.4.5 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:28312f96f28c723f098147a02e9b8b49781178382e088c192f0a0c37c6952eeb_s390x as a component of Multicluster Global Hub 1.4.5 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:28312f96f28c723f098147a02e9b8b49781178382e088c192f0a0c37c6952eeb_s390x |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ad0096b855e5e9612b8e576186763c76df6671ded8f66ce2b861a57bfbe3c622_amd64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ad0096b855e5e9612b8e576186763c76df6671ded8f66ce2b861a57bfbe3c622_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ffd0e799f2b3889a4c9a8971d79bbcc2e863b7405f44d1e22d774963b9520dd3_s390x as a component of Multicluster Global Hub 1.4.5 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ffd0e799f2b3889a4c9a8971d79bbcc2e863b7405f44d1e22d774963b9520dd3_s390x |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7de5a370e926553a091305bcdb9f66fa1dba7cdff45838e4e9bf09a8c54bda93_amd64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7de5a370e926553a091305bcdb9f66fa1dba7cdff45838e4e9bf09a8c54bda93_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:de645819f0a36aa8c7a6997d7338ad9fa7b2fd300dc5322d68dfdaaa6f1bd184_ppc64le as a component of Multicluster Global Hub 1.4.5 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:1ef15bdb7bf1a9c13426d1ae25b675041e045958f80937b12d71cc15837eb585_amd64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:1ef15bdb7bf1a9c13426d1ae25b675041e045958f80937b12d71cc15837eb585_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:242aee0257e823b6537c263d99138a0e801a1d586f211c45290e64722c18acf4_amd64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:242aee0257e823b6537c263d99138a0e801a1d586f211c45290e64722c18acf4_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ef4b3040c03473c16c8c7f0dea8482337db9219a805fe4377c2bb976d33b59db_s390x as a component of Multicluster Global Hub 1.4.5 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bd8126c2bed30841364c5170ac349f9d6cb0f4e369147f39114bb068102a5bec_amd64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bd8126c2bed30841364c5170ac349f9d6cb0f4e369147f39114bb068102a5bec_amd64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:44120974278d52f6f302bba15ed9dc01602fe2e59dd2606cbfe53582aa38ace3_arm64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:44120974278d52f6f302bba15ed9dc01602fe2e59dd2606cbfe53582aa38ace3_arm64, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:08f79193f00ffd79cfa4b75a58bf71ac2f4b859badd6a46c3d03fcb4e59226f0_ppc64le as a component of Multicluster Global Hub 1.4.5 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:08f79193f00ffd79cfa4b75a58bf71ac2f4b859badd6a46c3d03fcb4e59226f0_ppc64le |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:17a65d2daf8836c1b88156f947a7a897f4713866df8dc0a69cf49cb94ec842e1_arm64 as a component of Multicluster Global Hub 1.4.5 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:17a65d2daf8836c1b88156f947a7a897f4713866df8dc0a69cf49cb94ec842e1_arm64 |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ca2fa685ba62b2e1a60282e28e60b74d4cd7f413fb8b6b5c3dab2f1184eaf649_s390x as a component of Multicluster Global Hub 1.4.5 | *, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ca2fa685ba62b2e1a60282e28e60b74d4cd7f413fb8b6b5c3dab2f1184eaf649_s390x |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d109c78975ea21f6b48bfa2c2c5bd734a7c1a28cf25cc7fc823fa381c4eaf805_arm64 as a component of Multicluster Global Hub 1.4.5 | * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:3be3e9b4f32e57f54582c3ea6e29defd189d412a89526001a366095186bd2f83_ppc64le as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:3be3e9b4f32e57f54582c3ea6e29defd189d412a89526001a366095186bd2f83_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bc1e1cc514bf3bcbb6f9f69ac076c56223edb0e8a3e31de2489371296654e19d_ppc64le as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bc1e1cc514bf3bcbb6f9f69ac076c56223edb0e8a3e31de2489371296654e19d_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:edda7701a3d88fe21a9b1b693db2d50d0430a657c8f08952c744cda4efa3e36e_arm64 as a component of Multicluster Global Hub 1.4.5 | registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:edda7701a3d88fe21a9b1b693db2d50d0430a657c8f08952c744cda4efa3e36e_arm64, * |
…and 1 more
Timeline
- Dec 18, 2025 CVE Published
- May 13, 2026 Distribution Patch
- May 13, 2026 Distribution Patch
- May 13, 2026 Security Advisory
- May 13, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:23644 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23644.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2413190 issue
- https://www.cve.org/CVERecord?id=CVE-2024-25621 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-25621 advisory
- https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5 advisory
- https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w advisory
- https://access.redhat.com/security/cve/CVE-2024-25621 advisory
- https://github.com/containerd/containerd/blob/main/docs/rootless.md advisory