TI-2024-27047 Aliases CVE-2024-40635 GHSA-265r-hfxg-fhmg

containerd has an integer overflow in User ID handling

LOW 34CWE-190Published 2025-03-17 · Updated 2025-05-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 20 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00304 23rd percentileScored 2026-11-07

Fix Partial containerd (containerd): 1.6.38, 1.7.27, 2.0.4github.com/containerd/containerd/v2 (Go): 2.0.4+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 20 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	containerd	before 1.6.38; 1.7.0-beta.0 to before 1.7.27; 2.0.0-beta.0 to before 2.0.4	1.6.38, 1.7.27, 2.0.4	Patch available	CNA
—	github.com/containerd/containerd/v2 (Go)	before 2.0.4	2.0.4	Patch available	GHSA-265r-hfxg-fhmg
—	github.com/containerd/containerd (Go)	1.7.0-beta.0 to before 1.7.27	1.7.27	Patch available	GHSA-265r-hfxg-fhmg
—	github.com/containerd/containerd (Go)	before 1.6.38	1.6.38	Patch available	GHSA-265r-hfxg-fhmg

containerd Vendorbackstage Affected before 1.6.38; 1.7.0-beta.0 to before 1.7.27; 2.0.0-beta.0 to before 2.0.4 Fixed in 1.6.38, 1.7.27, 2.0.4 Patch available CNA
github.com/containerd/containerd/v2 (Go) Vendor— Affected before 2.0.4 Fixed in 2.0.4 Patch available GHSA-265r-hfxg-fhmg
github.com/containerd/containerd (Go) Vendor— Affected 1.7.0-beta.0 to before 1.7.27 Fixed in 1.7.27 Patch available GHSA-265r-hfxg-fhmg
github.com/containerd/containerd (Go) Vendor— Affected before 1.6.38 Fixed in 1.6.38 Patch available GHSA-265r-hfxg-fhmg

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:containerd::::::::	before 1.6.38; 1.7.0 to before 1.7.27; 2.0.0 to before 2.0.4	Vulnerable	backstage
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions before 1.6.38; 1.7.0 to before 1.7.27; 2.0.0 to before 2.0.4 Vulnerable ·backstage
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Fix · CNA containerd (containerd) Fixed in 1.6.38, 1.7.27, 2.0.4
Fix · GHSA-265r-hfxg-fhmg github.com/containerd/containerd/v2 (Go) Fixed in 2.0.4 Advisory →
Fix · GHSA-265r-hfxg-fhmg github.com/containerd/containerd (Go) Fixed in 1.7.27 Advisory →
Fix · GHSA-265r-hfxg-fhmg github.com/containerd/containerd (Go) Fixed in 1.6.38 Advisory →

Red Hat 1 advisory

RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2	Affected	No fix yet: Fix deferred
Deployment Validation Operator	Affected	No fix yet: Fix deferred
Logging Subsystem for Red Hat OpenShift	Affected	No fix yet: Fix deferred
Migration Toolkit for Virtualization	Affected	No fix yet: Fix deferred
Multicluster Engine for Kubernetes	Affected	No fix yet: Fix deferred
Network Observability Operator	Affected	No fix yet: Fix deferred
OpenShift Developer Tools and Services	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
OpenShift Serverless	Affected	No fix yet: Fix deferred
OpenShift Service Mesh 3	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Security 4	Affected	No fix yet: Fix deferred
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift GitOps	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat Openshift Sandboxed Containers	Affected	No fix yet: Fix deferred
Red Hat Trusted Application Pipeline	Affected	No fix yet: Fix deferred
cert-manager Operator for Red Hat OpenShift	Affected	No fix yet: Fix deferred
Red Hat Openshift Data Foundation 4.22	Fixed	RHSA-2026:37387

Not affected: 1 product

Red Hat Openshift Data Foundation 4.22

Timeline

2026-10-02 Threatist record created from CVE-2024-40635
2026-10-03 Alias added: GHSA-265r-hfxg-fhmg
2026-10-27 Affected versions changed · Red Hat

References

Patch 3

Advisory 3

Other 1

https://github.com/containerd/containerd

TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences