CVE-2024-40635 containerd has an integer overflow in User ID handling
An integer overflow in containerd allows containers to run as root instead of a specified non-root user, enabling privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-40635?
CVE-2024-40635 is a medium-severity vulnerability in Debian Debian Linux, published on 17 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Weakness: CWE-190
Which versions are affected by CVE-2024-40635?
8 open source packages ship an affected version, including github.com/containerd/containerd and github.com/containerd/containerd/v2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containerd/containerd Go | All versions | 1.6.38, 1.7.27 |
github.com/containerd/containerd Go | All versions | 1.6.38 |
github.com/containerd/containerd Go | All versions | 1.6.38 |
github.com/containerd/containerd Go | From 1.7.0-beta.0 | 1.7.27 |
github.com/containerd/containerd Go | From 1.7.0-beta.0 | 1.7.27 |
github.com/containerd/containerd/v2 Go | All versions | 2.0.4 |
2 more packages
github.com/containerd/containerd/v2 Go | All versions | 2.0.4 |
github.com/containerd/containerd/v2 Go | All versions | 2.0.4 |
Linux distribution packages (12)
containerd SUSE:Linux Enterprise Micro 5.1 | All versions | 1.7.27-150000.123.1 |
containerd SUSE:Linux Enterprise Micro 5.2 | All versions | 1.7.27-150000.123.1 |
containerd SUSE:Linux Enterprise Micro 5.3 | All versions | 1.7.27-150000.123.1 |
containerd SUSE:Linux Enterprise Micro 5.4 | All versions | 1.7.27-150000.123.1 |
containerd SUSE:Linux Enterprise Micro 5.5 | All versions | 1.7.27-150000.123.1 |
containerd SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 1.7.27-150000.123.1 |
containerd SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.7.27-16.100.1 |
containerd SUSE:Linux Micro 6.0 | All versions | 1.7.27-1.1 |
containerd SUSE:Linux Micro 6.1 | All versions | 1.7.27-slfo.1.1_1.1 |
containerd openSUSE:Leap 15.6 | All versions | 1.7.27-150000.123.1 |
cmctl openSUSE:Tumbleweed | All versions | 2.2.0-1.1 |
containerd openSUSE:Tumbleweed | All versions | 1.7.27-1.1 |
Products include Debian Debian Linux, Linuxfoundation Containerd.
How do I fix CVE-2024-40635?
Upgrade github.com/containerd/containerd to a fixed version for your release line: 1.6.38 or 1.7.27.
Is CVE-2024-40635 being exploited?
There is no known exploitation of CVE-2024-40635 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-58844, AZL-58845, AZL-58867, AZL-60893, AZL-60897, BELL-CVE-2024-40635 and 98 more.