CVE-2024-25621

Executive Summary

CVE-2024-25621 is a vulnerability in the containerd container runtime, affecting versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1. The issue stems from overly broad default permissions set on critical directory paths: /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim. These directories were created with permissions that allow group or world access, potentially enabling a local attacker with low privileges to read sensitive data, modify container configurations, or escalate privileges. The vulnerability has a CVSS score of 7.3 (High) and is classified under CWE-276 (Incorrect Default Permissions). No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the risk is significant in multi-tenant environments or shared hosting scenarios.

Supply Chain & Package Security

This vulnerability affects the containerd package, which is a core component of many container orchestration platforms, including Docker and Kubernetes. Since containerd is written in Go and distributed as a binary or via package managers, the supply chain risk is moderate. Organizations should verify the integrity of containerd binaries using checksums and signatures provided by the official containerd releases. The vulnerability does not directly impact package registries (e.g., NPM, PyPI) but can affect any system running a vulnerable version of containerd.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges (e.g., a non-root user).
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Sensitive data in the affected directories could be exposed.
• Integrity (I): High (H) – An attacker could modify container configurations or data.
• Availability (A): High (H) – An attacker could disrupt container operations.

Threat Level: High. While the attack vector is local, the low privileges required and the potential for privilege escalation or data compromise make this a serious issue in multi-tenant environments.

Deep Dive & Mechanics

The vulnerability lies in the default file permissions set by containerd during installation or runtime. The affected directories are:

• /var/lib/containerd – Stores container images, snapshots, and metadata.
• /run/containerd/io.containerd.grpc.v1.cri – Contains Unix domain sockets for the CRI (Container Runtime Interface) gRPC service.
• /run/containerd/io.containerd.sandbox.controller.v1.shim – Contains sockets for sandbox controller shims.

These directories were created with permissions that allow group or world read/write/execute access (e.g., 0777 or 0755 with world-writable). This misconfiguration enables a local attacker with low privileges to:

1. Read sensitive data: Access container images, configuration files, or runtime metadata stored in /var/lib/containerd.
2. Modify container configurations: Write to directories or files, potentially altering container behavior or injecting malicious code.
3. Escalate privileges: By manipulating socket files, an attacker could intercept or impersonate containerd services, leading to privilege escalation.

The root cause is a lack of restrictive permission settings during directory creation. The fix involves setting appropriate permissions (e.g., 0700 for directories) to restrict access to the containerd user only.

Vulnerable vs. Patched Code

The vulnerability is not in the code logic but in the default permissions set during directory creation. Below is a comparison of the vulnerable and patched behavior.

Vulnerable (e.g., containerd 1.7.28):

// Example of directory creation with overly broad permissions
os.MkdirAll("/var/lib/containerd", 0755)
os.MkdirAll("/run/containerd/io.containerd.grpc.v1.cri", 0777)
os.MkdirAll("/run/containerd/io.containerd.sandbox.controller.v1.shim", 0777)

Patched (e.g., containerd 1.7.29):

// Example of directory creation with restrictive permissions
os.MkdirAll("/var/lib/containerd", 0700)
os.MkdirAll("/run/containerd/io.containerd.grpc.v1.cri", 0700)
os.MkdirAll("/run/containerd/io.containerd.sandbox.controller.v1.shim", 0700)

The patched code ensures that only the containerd user (typically root or a dedicated user) has access to these directories, preventing unauthorized local access.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Since no public exploit code is available, the following steps outline a manual exploitation scenario:

1. Prerequisites: Local access to a system running a vulnerable containerd version (e.g., 1.7.28) with a low-privileged user account.
2. Reconnaissance: Check permissions on the affected directories:

   ls -la /var/lib/containerd
   ls -la /run/containerd/io.containerd.grpc.v1.cri
   ls -la /run/containerd/io.containerd.sandbox.controller.v1.shim
   

3. Data Exfiltration: If world-readable, copy sensitive files:

   cp /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/* /tmp/exfil/
   

4. Privilege Escalation: If world-writable, modify a socket file to intercept containerd services:

   # Example: Replace a socket with a malicious one
   rm /run/containerd/io.containerd.grpc.v1.cri/containerd.sock
   ln -s /tmp/malicious.sock /run/containerd/io.containerd.grpc.v1.cri/containerd.sock
   

5. Impact: Gain access to container images, modify container configurations, or escalate to root.

Blue Team (Defense & Detection)

1. Audit Permissions: Regularly check permissions on containerd directories:

   stat -c "%a %n" /var/lib/containerd /run/containerd/io.containerd.grpc.v1.cri /run/containerd/io.containerd.sandbox.controller.v1.shim
   

2. Harden Permissions: Apply the workaround by manually setting restrictive permissions:

   chmod 0700 /var/lib/containerd
   chmod 0700 /run/containerd/io.containerd.grpc.v1.cri
   chmod 0700 /run/containerd/io.containerd.sandbox.controller.v1.shim
   

3. Run in Rootless Mode: Configure containerd to run in rootless mode to minimize the impact of local privilege escalation.
4. Monitor for Anomalies: Use file integrity monitoring (FIM) tools to detect unauthorized changes to containerd directories.

Indicators of Compromise (IOCs)

• File Permissions: Directories /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim with permissions other than 0700 (e.g., 0755, 0777).
• Unauthorized Files: Presence of unexpected files or sockets in these directories.
• Process Anomalies: Unusual processes accessing containerd sockets or directories from non-root users.
• Log Entries: Audit logs showing chmod or chown operations on containerd directories by non-root users.

Detection Engineering

YARA Rule

rule CVE_2024_25621_Containerd_Permissions {
    meta:
        description = "Detects overly broad permissions on containerd directories"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-25621"
    strings:
        $dir1 = "/var/lib/containerd"
        $dir2 = "/run/containerd/io.containerd.grpc.v1.cri"
        $dir3 = "/run/containerd/io.containerd.sandbox.controller.v1.shim"
    condition:
        (filesize < 10KB) and
        (uint16(0) == 0x4D5A or uint32(0) == 0x464c457f) and
        for any of ($dir*) : ($ in (0..filesize))
}

Sigma Rule

title: CVE-2024-25621 - Containerd Overly Broad Permissions
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of containerd directories with overly broad permissions
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith:
            - '/var/lib/containerd'
            - '/run/containerd/io.containerd.grpc.v1.cri'
            - '/run/containerd/io.containerd.sandbox.controller.v1.shim'
        FileCreateAttributes|contains: '0777'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-25621 - Containerd Overly Broad Permissions"; flow:to_server; content:"/var/lib/containerd"; nocase; content:"0777"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions

1. Upgrade containerd to a patched version (1.7.29, 2.0.7, 2.1.5, or 2.2.0) as soon as possible.
2. Apply workaround: Manually set restrictive permissions on the affected directories:

   sudo chmod 0700 /var/lib/containerd
   sudo chmod 0700 /run/containerd/io.containerd.grpc.v1.cri
   sudo chmod 0700 /run/containerd/io.containerd.sandbox.controller.v1.shim
   

3. Run containerd in rootless mode to reduce the attack surface.

Long-Term Measures

• Implement file integrity monitoring (FIM) for containerd directories.
• Enforce least privilege principles for all container runtime components.
• Regularly audit system configurations for insecure permissions.
• Use security tools like SELinux or AppArmor to confine containerd processes.

Patch Details

• Fixed versions: containerd 1.7.29, 2.0.7, 2.1.5, 2.2.0.
• Patch source: Official containerd GitHub repository (https://github.com/containerd/containerd).
• Workaround: Manual chmod or rootless mode.

Valters IT