Read the docs
TI-2024-16849 Aliases CVE-2024-25621GHSA-pwhc-rpq9-4c8w

containerd affected by a local privilege escalation via wide permissions on CRI directory

Priority LOW 35CWE-279Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 13 fixed, 17 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix Partial containerd (containerd): 1.7.29, 2.0.7, 2.1.5 +1github.com/containerd/containerd (Go): 1.7.29+1 more productRed Hat: 13 advisoriesRed Hat: 13 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagecontainerdbefore 1.7.29; 2.0.0-beta.0 to before 2.0.7; 2.1.0-beta.0 to before 2.1.5; 2.2.0-beta.0 to before 2.2.01.7.29, 2.0.7, 2.1.5, 2.2.0Patch availableCNA
—github.com/containerd/containerd (Go)before 1.7.291.7.29Patch availableGHSA-pwhc-rpq9-4c8w
—github.com/containerd/containerd/v2 (Go)before 2.0.72.0.7Patch availableGHSA-pwhc-rpq9-4c8w
—github.com/containerd/containerd/v2 (Go)2.1.0-beta.0 to before 2.1.52.1.5Patch availableGHSA-pwhc-rpq9-4c8w
—github.com/containerd/containerd/v2 (Go)2.2.0-beta.0 to before 2.2.02.2.0Patch availableGHSA-pwhc-rpq9-4c8w
  • containerd Vendorbackstage Affected before 1.7.29; 2.0.0-beta.0 to before 2.0.7; 2.1.0-beta.0 to before 2.1.5; 2.2.0-beta.0 to before 2.2.0 Fixed in 1.7.29, 2.0.7, 2.1.5, 2.2.0 Patch available CNA
  • github.com/containerd/containerd (Go) Vendor— Affected before 1.7.29 Fixed in 1.7.29 Patch available GHSA-pwhc-rpq9-4c8w
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected before 2.0.7 Fixed in 2.0.7 Patch available GHSA-pwhc-rpq9-4c8w
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.1.0-beta.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-pwhc-rpq9-4c8w
  • github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.2.0-beta.0 to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-pwhc-rpq9-4c8w

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*before 1.7.29; 2.0.0 to before 2.0.7; 2.1.0 to before 2.1.5Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta0:*:*:*:*:*:*2.2.0 beta0Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta1:*:*:*:*:*:*2.2.0 beta1Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta2:*:*:*:*:*:*2.2.0 beta2Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc0:*:*:*:*:*:*2.2.0 rc0Vulnerablebackstage
cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc1:*:*:*:*:*:*2.2.0 rc1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions before 1.7.29; 2.0.0 to before 2.0.7; 2.1.0 to before 2.1.5 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta0:*:*:*:*:*:* Versions 2.2.0 beta0 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta1:*:*:*:*:*:* Versions 2.2.0 beta1 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta2:*:*:*:*:*:* Versions 2.2.0 beta2 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc0:*:*:*:*:*:* Versions 2.2.0 rc0 Vulnerable ·backstage
  • cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc1:*:*:*:*:*:* Versions 2.2.0 rc1 Vulnerable ·backstage

Remediation

  • Fix · CNA containerd (containerd) Fixed in 1.7.29, 2.0.7, 2.1.5, 2.2.0
  • Fix · GHSA-pwhc-rpq9-4c8w github.com/containerd/containerd (Go) Fixed in 1.7.29 Advisory →
  • Fix · GHSA-pwhc-rpq9-4c8w github.com/containerd/containerd/v2 (Go) Fixed in 2.0.7 Advisory →
  • Fix · GHSA-pwhc-rpq9-4c8w github.com/containerd/containerd/v2 (Go) Fixed in 2.1.5 Advisory →
  • Fix · GHSA-pwhc-rpq9-4c8w github.com/containerd/containerd/v2 (Go) Fixed in 2.2.0 Advisory →

Red Hat 13 advisories

  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:25127 Released 2026-06-10 · Red Hat rating Important
    Submariner v0.21 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
Show 10 more Red Hat advisories
  • RHSA-2026:5807 Released 2026-03-25 · Red Hat rating Important
    RHOAI 2.16.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3122 Released 2026-02-23 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 director Operator container images
    • Red Hat OpenStack Platform 16.2 registry.redhat.io/rhosp-rhel8/osp-director-agent, registry.redhat.io/rhosp-rhel8/osp-director-operator
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2343 Released 2026-02-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9 +8
  • RHSA-2025:23644 Released 2025-12-18 · Red Hat rating Important
    Red Hat multicluster global hub 1.4.3 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2025:23428 Released 2025-12-17 · Red Hat rating Important
    Red Hat multicluster global hub 1.5.2 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
  • RHSA-2025:23248 Released 2025-12-16 · Red Hat rating Important
    RHSA 4.7.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.7 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2025:22955 Released 2025-12-09 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1.12 director Operator container images
    • Red Hat OpenStack Platform 17.1 registry.redhat.io/rhosp-rhel9/osp-director-agent, registry.redhat.io/rhosp-rhel9/osp-director-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Deployment Validation OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Multicluster Global Hub 1.4.9Fixed RHSA-2025:23644
Multicluster Global Hub 1.5.8Fixed RHSA-2025:23428
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift API for Data Protection 1.5Fixed RHSA-2026:2343
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:25127
Red Hat Advanced Cluster Security 4.7Fixed RHSA-2025:23248
Red Hat OpenShift AI 2.16Fixed RHSA-2026:5807
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenStack Platform 16.2Fixed RHSA-2026:3122
Red Hat OpenStack Platform 17.1Fixed RHSA-2025:22955
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Not affected: 42 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Compliance Operator
  • Confidential Compute Attestation
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • File Integrity Operator
  • Gatekeeper 3
  • Kernel Module Management Operator for Red Hat Openshift
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Machine Deletion Remediation Operator
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift API for Data Protection 1.3
  • OpenShift API for Data Protection 1.5
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Power monitoring for Red Hat OpenShift
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Security 4.7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Kueue
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.16
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift for Windows Containers
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Trusted Artifact Signer

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25621
  2. 2026-10-03 Alias added: GHSA-pwhc-rpq9-4c8w
  3. 2026-10-31 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

Other 2

  • TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
  • TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
  • TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
  • TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
  • TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
  • TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences