Improper Preservation of Permissions in containerd - CVE-2025-47291
Published: May 21, 2025
Vulnerability identifier: #VU109622
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-47291
CWE-ID: CWE-281
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to the CRI implementation does not put usernamespaced containers under the Kubernetes' cgroup hierarchy, which causes Kubernetes limits not to be honored. A local user or malicious application inside the container can perform a denial of service (DoS) attack.
Affected software
containerd
Robotic Process Automation for Cloud Pak
Robotic Process Automation for Cloud Pak
How to mitigate CVE-2025-47291
Install updates from vendor's website.
containerd - update to 2.0.5
Robotic Process Automation for Cloud Pak - update to 23.0.20.3
Robotic Process Automation for Cloud Pak - update to 23.0.20.3