Improper preservation of permissions in containerd CRI plugin

1) Improper Preservation of Permissions

EUVDB-ID: #VU109622

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47291

CWE-ID: CWE-281 - Improper preservation of permissions

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to the CRI implementation does not put usernamespaced containers under the Kubernetes' cgroup hierarchy, which causes Kubernetes limits not to be honored. A local user or malicious application inside the container can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

containerd: 2.0.1 - 2.0.4

CPE2.3

• cpe:2.3:a:containerd:containerd:2.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:containerd:containerd:2.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:containerd:containerd:2.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:containerd:containerd:2.0.4:*:*:*:*:*:*:*

External links

https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.