containerd affected by a local privilege escalation via wide permissions on CRI directory
Résumé
containerd affected by a local privilege escalation via wide permissions on CRI directory
Description d'origine
La description telle que publiée par la source (souvent en anglais).
containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri and /run/containerd/io.containerd.sandbox.controller.v1.shim were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-25621 containerd Corrigé dans: 1.4.13~ds1-1~deb11u6
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com