CVE-2024-25621: Containerd Privilege Escalation Flaw

CVE-2024-25621 Overview

CVE-2024-25621 is an insecure permissions vulnerability in containerd, an open-source container runtime widely used by Docker, Kubernetes, and other container platforms. The runtime creates several state and runtime directories with overly broad default permissions. Specifically, /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim are created with group- and world-readable modes. A local user with access to the host can read sensitive container state data that should be restricted to the containerd owner. The issue is classified as [CWE-279: Incorrect Execution-Assigned Permissions].

Critical Impact
Local users on affected hosts can access sensitive container runtime directories, potentially exposing container state, secrets, and metadata that should be restricted to privileged accounts.

Affected Products

containerd versions 0.1.0 through 1.7.28
containerd 2.0.0-beta.0 through 2.0.6
containerd 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1

Discovery Timeline

2025-11-06 - CVE-2024-25621 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25621

Vulnerability Analysis

The vulnerability stems from containerd creating its root and state directories with mode 0o711, which grants execute permission to group and world. While 0o711 prevents directory listing, it still allows any local user to traverse into these directories and access files whose names they can guess or enumerate through other means. Sensitive container runtime artifacts, sockets, and shim state files reside beneath these paths. A local unprivileged user can leverage this exposure to read data that supports container operation, escalate access within the host, or interact with runtime sockets exposed by plugins.

Root Cause

The defect is a design-time permission choice. The MkdirAllWithACL call in cmd/containerd/server/server.go set the root directory mode to 0o711 instead of 0o700. This allowed non-owner accounts to cd into the directory tree even though they could not list its contents. The state directory retained 0o711 to support userns-remapped containers, but child directories now inherit tighter defaults set by their plugin owners.

Attack Vector

Exploitation requires local access to the host running containerd and a low-privileged user account. No user interaction is needed. The attacker leverages the traversable permission bit on the parent directory to reach child paths, sockets, or state files that leak container information or enable further privilege escalation.

// Patch: cmd/containerd/server/server.go
		return errors.New("root and state must be different paths")
	}

-	if err := sys.MkdirAllWithACL(config.Root, 0o711); err != nil {
+	if err := sys.MkdirAllWithACL(config.Root, 0o700); err != nil {
+		return err
+	}
+	// chmod is needed for upgrading from an older release that created the dir with 0o711
+	if err := os.Chmod(config.Root, 0o700); err != nil {
		return err
	}

+	// For supporting userns-remapped containers, the state dir cannot be just mkdired with 0o700.
+	// Each of plugins creates a dedicated directory beneath the state dir with appropriate permission bits.
	if err := sys.MkdirAllWithACL(config.State, 0o711); err != nil {
		return err
	}

Source: containerd commit 7c59e8e

Detection Methods for CVE-2024-25621

Indicators of Compromise

Directory permissions on /var/lib/containerd matching 0711 or broader instead of 0700.
Directory permissions on /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim allowing group or world traversal.
Access logs showing non-root user processes traversing containerd runtime directories.

Detection Strategies

Run stat -c '%a %n' /var/lib/containerd /run/containerd/io.containerd.grpc.v1.cri /run/containerd/io.containerd.sandbox.controller.v1.shim across the fleet and flag any result greater than 700.
Query the installed containerd version and alert on versions prior to 1.7.29, 2.0.7, 2.1.5, and 2.2.0.
Audit execve and openat telemetry for non-privileged UIDs accessing containerd state paths.

Monitoring Recommendations

Enable Linux audit rules on containerd root and state paths to record access from unexpected users.
Track containerd package versions and patch status through configuration management inventory.
Alert on unexpected chmod or chown operations targeting the containerd runtime directory tree.

How to Mitigate CVE-2024-25621

Immediate Actions Required

Upgrade containerd to version 1.7.29, 2.0.7, 2.1.5, or 2.2.0 depending on your release branch.
Manually restrict permissions on /var/lib/containerd and the affected /run/containerd subdirectories until the upgrade is applied.
Inventory hosts running Docker, Kubernetes nodes, and other container platforms that bundle containerd.

Patch Information

The fix landed in commit 7c59e8e9e970d38061a77b586b23655c352bfec5, which changes the root directory mode from 0o711 to 0o700 and adds an explicit os.Chmod call to correct permissions on upgrade. Refer to the containerd security advisory GHSA-pwhc-rpq9-4c8w for release details.

Workarounds

Restrict host access so only the containerd owner can log in, then chmod the affected directories to remove group and world bits.
Run containerd in rootless mode as documented in the containerd rootless guide.

bash

# Configuration example: restrict permissions on containerd directories
sudo chmod 0700 /var/lib/containerd
sudo chmod 0700 /run/containerd/io.containerd.grpc.v1.cri
sudo chmod 0700 /run/containerd/io.containerd.sandbox.controller.v1.shim

# Verify
stat -c '%a %n' /var/lib/containerd \
  /run/containerd/io.containerd.grpc.v1.cri \
  /run/containerd/io.containerd.sandbox.controller.v1.shim