{"id":"CVE-2024-40635","published":"2025-03-17T21:32:37Z","modified":"2025-05-04T22:02:39Z","title":"containerd has an integer overflow in User ID handling","vendor":"containerd","product":"containerd","tier":"tail","description":{"text":"containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00304,"percentile":0.23217,"provenance":"source"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da","tags":["x_refsource_MISC"]},{"url":"https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20","tags":["x_refsource_MISC"]},{"url":"https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html","tags":[]}],"priority":{"score":12.9,"factors":[{"name":"EPSS percentile","points":4.64},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.22}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-04-30","earliestUrl":"https://github.com/yen5004/CVE-2024-40635_POC","repos":[{"name":"yen5004/CVE-2024-40635_POC","url":"https://github.com/yen5004/CVE-2024-40635_POC","stars":0,"created":"2025-04-30"}]},"first":{"date":"2025-04-30","source":"PoC-in-GitHub","url":"https://github.com/yen5004/CVE-2024-40635_POC"},"provenance":"source"},"vendorSlug":"containerd","affectedVersions":[{"vendor":"containerd","product":"containerd","versions":["< 1.6.38",">= 1.7.0-beta.0, < 1.7.27",">= 2.0.0-beta.0, < 2.0.4"]}],"affected":[{"ecosystem":"Go","package":"github.com/containerd/containerd/v2","vulnerableRanges":["<2.0.4"],"patched":["2.0.4"],"from":["GHSA-265r-hfxg-fhmg","GO-2025-3528"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/containerd/containerd","vulnerableRanges":[">=1.7.0-beta.0, <1.7.27","<1.6.38"],"patched":["1.7.27","1.6.38"],"from":["GHSA-265r-hfxg-fhmg","GO-2025-3528"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-6529","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-containerd-cve-2021-43816","parents":[{"from":"CVE-2023-25173","to":"CVE-2024-40635","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["oci/spec_opts.go"],"commits":["https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a","https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da","https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20"],"basis":"shared function","functions":["WithUser"]}]}],"packageHistory":[{"cve":"CVE-2022-23471","published":"2022-12-07","fixed":"1.6.12","kev":false},{"cve":"CVE-2023-25153","published":"2023-02-16","fixed":"1.6.18","kev":false},{"cve":"CVE-2023-25173","published":"2023-02-16","fixed":"1.6.18","kev":false},{"cve":"CVE-2024-40635","published":"2025-03-17","fixed":"1.7.27","kev":false},{"cve":"CVE-2024-25621","published":"2025-11-06","fixed":"1.7.29","kev":false,"link":{"from":"CVE-2024-40635","to":"CVE-2024-25621","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/containerd/containerd","fromFixed":"1.7.27","toFixed":"1.7.29","daysApart":234}]}},{"cve":"CVE-2025-64329","published":"2025-11-07","fixed":"1.7.29","kev":false,"link":{"from":"CVE-2024-40635","to":"CVE-2025-64329","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/containerd/containerd","fromFixed":"1.7.27","toFixed":"1.7.29","daysApart":235}]}},{"cve":"CVE-2026-46680","published":"2026-07-01","fixed":"1.7.32","kev":false}],"package":"Go:github.com/containerd/containerd"}}