CVE-2024-40635: Containerd Privilege Escalation Vulnerability

CVE-2024-40635 Overview

CVE-2024-40635 is an integer overflow vulnerability in containerd, an open-source container runtime. The flaw affects containerd versions prior to 1.6.38, 1.7.27, and 2.0.4. When a container is launched with a User value specifying a UID:GID larger than the maximum 32-bit signed integer, an overflow occurs. The container then runs as root (UID 0) instead of the intended non-root user. This behavior breaks least-privilege assumptions in environments that rely on non-root container execution for isolation and hardening.

Critical Impact
Containers configured to run as non-root can silently execute as UID 0, bypassing runtime security controls and enabling privilege-based attacks against the container and host.

Affected Products

Linux Foundation containerd versions prior to 1.6.38
Linux Foundation containerd 1.7.x versions prior to 1.7.27
Linux Foundation containerd 2.0.x versions prior to 2.0.4
Debian Linux 11 (Bullseye) shipped packages

Discovery Timeline

2025-03-17 - CVE-2024-40635 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40635

Vulnerability Analysis

The vulnerability is classified under CWE-190: Integer Overflow or Wraparound. containerd accepts a User field in container specifications formatted as UID:GID. When these values exceed the maximum signed 32-bit integer (2147483647), the conversion logic overflows. The resulting value collapses to 0, which the kernel interprets as the root user.

A local attacker with permission to create or import container images and specify user identifiers can trigger the overflow. The container then executes with full root privileges inside its namespace. In environments that assume non-root execution as a hardening baseline, this defeats runtime authorization checks, admission policies, and defense-in-depth controls layered above the runtime.

Root Cause

The defect stems from unsafe numeric parsing and conversion of user-supplied UID and GID values without upper-bound validation. containerd converted large integers into a signed 32-bit representation, and values above the signed maximum wrapped to zero. The fix, applied in commits 05044ec0, 1a43cb6a, and cf158e88, rejects UID/GID values that would overflow the expected range.

Attack Vector

Exploitation requires local access with permission to launch containers or import images that specify a crafted User field. An attacker supplies a UID:GID value such as 2147483648:2147483648 in the container specification or image manifest. Because containerd resolves the overflowed value to UID 0, the container process starts as root. A proof-of-concept is publicly available at the CVE-2024-40635 POC repository.

The vulnerability manifests through unsigned-to-signed integer conversion in the runtime's user resolution path. Refer to the GitHub Security Advisory GHSA-265r-hfxg-fhmg for the full technical description.

Detection Methods for CVE-2024-40635

Indicators of Compromise

Container image manifests or Kubernetes PodSpecs containing User or runAsUser values greater than 2147483647.
Container processes running as UID 0 in workloads that policy or manifests declare as non-root.
Unexpected image imports from untrusted registries or users with image-push permissions.

Detection Strategies

Audit running containers and compare the effective UID of the container's PID 1 against the declared User in the image or PodSpec.
Scan container images and manifests for numeric UID or GID values above the signed 32-bit maximum.
Enforce admission-control policies (for example, OPA Gatekeeper or Kyverno) that reject workloads with UID or GID values outside a validated range.

Monitoring Recommendations

Alert on process execution as UID 0 inside containers marked non-root by orchestrator metadata.
Log and review all image imports and container create events processed by containerd on affected hosts.
Correlate containerd runtime versions across the fleet with the fixed releases 1.6.38, 1.7.27, and 2.0.4.

How to Mitigate CVE-2024-40635

Immediate Actions Required

Upgrade containerd to 1.6.38, 1.7.27, or 2.0.4 or later on all nodes running the container runtime.
Debian 11 operators should apply updates referenced in the Debian LTS Announcement.
Restrict image import and container creation privileges to trusted users and automation identities.
Review orchestrator security contexts to confirm containers declared as non-root are executing under a valid non-zero UID.

Patch Information

The upstream fix is available in containerd releases 1.6.38, 1.7.27, and 2.0.4. See the containerd GitHub Security Advisory GHSA-265r-hfxg-fhmg for release notes and the commits 05044ec0, 1a43cb6a, and cf158e88.

Workarounds

Allow only trusted images from validated registries and enforce image signing where feasible.
Restrict container image import permissions to a minimal set of trusted operators.
Deploy admission policies that reject workloads specifying UID or GID values above 65535 or outside your organization's allowed range.
Enable user namespace remapping and Pod Security Standards enforcement to constrain the impact of unexpected root execution.

bash

# Kyverno policy snippet: reject workloads with overflow-range UID/GID
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-overflow-uid-gid
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-runAsUser-range
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "runAsUser and runAsGroup must be between 1 and 65535."
        pattern:
          spec:
            securityContext:
              runAsNonRoot: true
              runAsUser: "1-65535"
              runAsGroup: "1-65535"