CVE-2025-47290 Overview
CVE-2025-47290 is a time-of-check to time-of-use (TOCTOU) race condition in containerd version 2.1.0. The flaw resides in the image unpacking logic executed during an image pull. A specially crafted container image can exploit the race window to arbitrarily modify the host file system outside the intended root directory. Only containerd 2.1.0 is affected; all other releases are unaffected. The maintainers fixed the issue in containerd 2.1.1.
Critical Impact
A malicious container image can escape the unpack root and write to arbitrary paths on the host, enabling container escape and host compromise.
Affected Products
- containerd 2.1.0
- Kubernetes clusters using containerd 2.1.0 as the container runtime
- Container platforms and CI/CD systems pulling untrusted images with containerd 2.1.0
Discovery Timeline
- 2025-05-20 - CVE-2025-47290 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-47290
Vulnerability Analysis
The vulnerability is a TOCTOU race condition classified under [CWE-367]. During an image pull, containerd unpacks tar layers into a root directory on the host. The unpack routine resolves each file path against the root before writing. An attacker who controls the image contents can change the file system state between the resolution check and the subsequent write operation. The write then targets a path outside the intended root. The result is arbitrary file creation, overwrite, or modification on the host running containerd.
Root Cause
The root cause is a memoization cache used to speed up repeated root path resolution during layer application. The cached path resolution logic (cachedRootPath) trusts previously computed results without re-validating symbolic link state at the time the file is written. A layer can introduce symlinks that redirect the cached path to a location outside the unpack root. Because the cache short-circuits the safety check performed by fs.RootPath, the subsequent write follows the attacker-controlled symlink.
Attack Vector
Exploitation requires the victim to pull a malicious image using containerd 2.1.0. The attack requires user action such as docker pull, ctr images pull, or an automated deployment that fetches the crafted image. No authentication to the host is needed. Once the layer is unpacked, the attacker can overwrite files such as SSH configurations, systemd units, or binaries on PATH, leading to privilege escalation or code execution as the containerd process user (typically root).
return options.applyFunc(ctx, root, r, options)
}
-// cachedRootPath will memoize root paths, avoiding redundant checks.
-type cachedRootPath struct {
- root string
- cache map[string]string
-}
-
-func newCachedRootPath(root string) *cachedRootPath {
- return &cachedRootPath{
- root: root,
- cache: make(map[string]string),
- }
-}
-
-func (c *cachedRootPath) get(path string) (string, error) {
- if hit, ok := c.cache[path]; ok {
- return hit, nil
- }
- p, err := fs.RootPath(c.root, path)
- if err != nil {
- return "", err
- }
- c.cache[path] = p
- return p, nil
-}
-
// applyNaive applies a tar stream of an OCI style diff tar to a directory
// applying each file as either a whole file or whiteout.
Source: containerd commit cada13298fba85493badb6fecb6ccf80e49673cc. The patch removes the vulnerable cachedRootPath memoization so each path is re-resolved without relying on stale cached values.
Detection Methods for CVE-2025-47290
Indicators of Compromise
- Files modified or created outside the containerd snapshotter root (default /var/lib/containerd/) shortly after an image pull operation.
- Unexpected symbolic links appearing inside pulled image layers pointing to absolute host paths such as /etc, /root/.ssh, or /usr/bin.
- Image pulls originating from untrusted registries followed by modifications to sensitive host files.
Detection Strategies
- Inventory containerd versions across all hosts and flag any node running exactly version 2.1.0.
- Monitor file integrity on host directories that containerd should never write to, correlating changes with containerd process activity.
- Audit registry sources referenced by image pull events and alert on pulls from unapproved registries.
Monitoring Recommendations
- Enable auditd or eBPF-based file access monitoring on /etc, /usr, /root, and /var/lib with the containerd process as the subject.
- Log all image pull events from Kubernetes kubelet and containerd, retaining image digests for forensic review.
- Alert on the creation of symlinks by the containerd process that resolve outside its snapshotter directory tree.
How to Mitigate CVE-2025-47290
Immediate Actions Required
- Upgrade containerd from 2.1.0 to 2.1.1 or later on every host and node in the environment.
- Restrict image pulls to trusted, signed registries and block pulls from arbitrary sources until patching is complete.
- Limit the set of users and service accounts authorized to import or pull container images.
Patch Information
The fix is available in containerd 2.1.1. See the GitHub Release v2.1.1 and the GitHub Security Advisory GHSA-cm76-qm8v-3j95 for release notes and advisory text. The upstream fix is applied in commit cada13298fba85493badb6fecb6ccf80e49673cc.
Workarounds
- Use only trusted, signed container images verified with cosign or an equivalent content trust mechanism.
- Restrict permissions to import or pull images to a small set of trusted operators and service accounts.
- Downgrade containerd to a pre-2.1.0 release if 2.1.1 cannot be deployed immediately, keeping in mind other feature and CVE tradeoffs.
# Verify containerd version and upgrade if 2.1.0 is present
containerd --version
# Debian/Ubuntu example
sudo apt-get update && sudo apt-get install --only-upgrade containerd.io
# Kubernetes node upgrade workflow
kubectl cordon <node>
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
# Upgrade containerd to >= 2.1.1 on the node, then:
sudo systemctl restart containerd
kubectl uncordon <node>
# Confirm the fixed version
containerd --version # expect v2.1.1 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
