Threats tagged 'ghsa-pwhc-rpq9-4c8w'

CVE-2024-25621 is a local privilege escalation vulnerability in containerd caused by overly broad default permissions on certain directories. Specifically, /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim were created with permissions that allowed local users to access sensitive metadata and volume contents, potentially leading to privilege escalation. The issue has been fixed in containerd versions 1.7.29, 2.0.7, 2.1.5, and 2.2.0. Users are advised to update to these versions or manually restrict directory permissions as a workaround. Running containerd in rootless mode is also a mitigation option.