Incorrect default permissions in containerd - CVE-2024-25621

Vulnerability identifier: #VU118141

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-25621

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions set for critical files, such as /var/lib/containerd (0711 instead of 0700), /run/containerd/io.containerd.grpc.v1.cri (0755 instead of 0700), and /run/containerd/io.containerd.sandbox.controller.v1.shim (0711 instead of 0700) and for the temp directory. A local user can escalate privileges on the system.

containerd
StreamSets Cartridge
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Containers Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Engineering Lifecycle Management
IBM Observability with Instana
Multicluster GlobalHub
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenStack
containerd
containerd (Ubuntu package)
containerd (Debian package)
containerd-doc
containerd-ctr
containerd-devel

Install updates from vendor's website.

containerd - addressed in versions 1.7.29, 2.0.7, 2.1.5, 2.2.0
Engineering Lifecycle Management - update to 1.3.0
IBM Observability with Instana - update to 1.0.311
Multicluster GlobalHub - addressed in versions 1.4.3, 1.5.2
Red Hat Advanced Cluster Security for Kubernetes - update to 4.7.9
Red Hat OpenStack - update to 17.1.12
containerd - addressed in versions 1.2.0-222, 1.2.0-324, 1.6.22-25
containerd (Ubuntu package) - addressed in versions 1.2.6-0ubuntu1~16.04.6+esm6, 1.6.12-0ubuntu1~18.04.1+esm3, 1.6.12-0ubuntu1~20.04.8+esm1, 1.6.12-0ubuntu1~22.04.10, 1.6.24~ds1-1ubuntu1.3+esm2, 1.7.24~ds1-8ubuntu1.1, 1.7.24-0ubuntu1~20.04.2+esm1, 1.7.28-0ubuntu1~22.04.1+esm1, 1.7.28-0ubuntu1~24.04.2, 2.1.3-0ubuntu3.1
containerd (Debian package) - addressed in versions 1.6.20~ds1-1+deb12u2, 1.7.24~ds1-6+deb13u1
containerd-doc - update to 1.7.29-1
containerd - update to 1.7.29-1
containerd - addressed in versions 1.7.29-16.105.1, 1.7.29-150000.128.1
containerd-ctr - addressed in versions 1.7.29-16.105.1, 1.7.29-150000.128.1
containerd-devel - addressed in versions 1.7.29-16.105.1, 1.7.29-150000.128.1

• https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w

• Multiple vulnerabilities in containerd
• SUSE update for containerd
• openEuler 22.03 LTS SP3 update for containerd
• openEuler 24.03 LTS SP2 update for containerd
• openEuler 24.03 LTS SP1 update for containerd
• openEuler 24.03 LTS update for containerd
• openEuler 22.03 LTS SP4 update for containerd
• SUSE update for containerd
• Debian update for containerd
• Anolis OS update for containerd
• Multiple vulnerabilities in Red Hat OpenStack Platform 17.1
• openEuler 20.03 LTS SP4 update for containerd
• Multiple vulnerabilities in Red Hat Advanced Cluster Security (RHACS) 4.7
• Red Hat Multicluster GlobalHub 1.4 update for containerd
• Red Hat Multicluster GlobalHub 1.5 update for containerd
• Multiple vulnerabilities in IBM Observability with Instana (Agent)
• Ubuntu update for containerd
• Multiple vulnerabilities in IBM Engineering Lifecycle Management on Hybrid Cloud
• IBM StreamSets Cartridge update for containerd