CVE-2025-47290

Executive Summary

CVE-2025-47290 is a critical Time-of-Check to Time-of-Use (TOCTOU) vulnerability discovered in containerd v2.1.0. This flaw allows a malicious actor to craft a container image that, when unpacked during an image pull, can arbitrarily modify the host file system. The vulnerability is specific to containerd version 2.1.0 and has been patched in version 2.1.1. The attack vector is network-based, requires no authentication, and can lead to full host compromise. Given the nature of container runtimes, this vulnerability poses a severe risk to any environment using containerd 2.1.0, including Kubernetes clusters and standalone container deployments.

Supply Chain & Package Security

This vulnerability is a supply chain risk because it exploits the image pulling and unpacking process. An attacker could compromise a container registry or trick a user into pulling a malicious image, leading to host-level compromise. Organizations must ensure that only trusted images from verified sources are used and that image signing and verification mechanisms are in place.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action beyond pulling an image.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full file system access can lead to data exfiltration.
• Integrity (I): High (H) - Arbitrary file modification is possible.
• Availability (A): High (H) - An attacker could disrupt the host system.

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) flaw in containerd's image unpacking logic. When a container image is pulled, containerd performs a series of checks on the image layers before writing them to the host file system. The vulnerability exists because there is a window between the time a layer is checked (e.g., for symlink safety) and the time it is actually written to disk. An attacker can craft a malicious image layer that passes the initial checks but is then modified (e.g., by a concurrent process or by exploiting the unpacking order) to contain a symlink pointing to an arbitrary host path. When containerd writes the layer contents, it follows the symlink and writes files to the attacker-controlled location, effectively achieving arbitrary file write on the host.

The attack flow:

1. Attacker crafts a malicious container image with a layer that contains a symlink to a sensitive host path (e.g., /etc/shadow or /etc/ld.so.preload).
2. The image is pushed to a registry.
3. A victim pulls the image using containerd 2.1.0.
4. During unpacking, containerd checks the layer for dangerous symlinks. The check passes because the symlink is not yet present or is hidden.
5. Between the check and the write, the attacker's layer is modified (e.g., by a race condition or by exploiting the order of layer extraction) to introduce the malicious symlink.
6. containerd writes the layer contents, following the symlink and overwriting host files.

Vulnerable vs. Patched Code

The vulnerable code is in the image unpacking logic of containerd 2.1.0. The patch in 2.1.1 likely addresses the race condition by either locking the file system operations or by performing the check and write atomically.

Vulnerable Code (Conceptual):

// containerd 2.1.0 - TOCTOU vulnerability
func unpackLayer(layer Layer) error {
    // Check for dangerous symlinks
    if hasDangerousSymlinks(layer) {
        return ErrDangerousSymlink
    }
    // Time-of-check to time-of-use window
    // Attacker can modify layer here
    // Write layer to disk
    return writeLayerToDisk(layer)
}

Patched Code (Conceptual):

// containerd 2.1.1 - Fixed
func unpackLayer(layer Layer) error {
    // Atomic check and write
    return atomicUnpack(layer)
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Environment: A Linux VM with containerd 2.1.0 installed.
2. Attacker Machine: A separate machine to host a malicious container registry or to push a malicious image to a public registry.
3. Tools: Docker, containerd CLI (ctr), and a custom image builder.

Exploitation Steps:

1. Create a malicious container image with a layer that contains a symlink to /etc/cron.d/malicious.
2. Push the image to a registry accessible by the victim.
3. On the victim machine, pull the image using ctr image pull.
4. The TOCTOU vulnerability will be triggered, and the attacker's cron job will be written to the host.
5. The cron job executes a reverse shell or other payload.

Proof-of-Concept (Conceptual):

# Attacker: Build and push malicious image
docker build -t malicious:latest .
docker push malicious:latest

# Victim: Pull image with containerd 2.1.0
ctr image pull malicious:latest

Blue Team

Detection Steps:

1. Monitor Image Pulls: Log all image pull requests and verify the source registry.
2. File Integrity Monitoring (FIM): Monitor critical system files (e.g., /etc/passwd, /etc/shadow, /etc/cron.d/) for unexpected changes.
3. Audit containerd Logs: Look for errors or warnings during image unpacking.
4. Network Monitoring: Detect connections to unknown or untrusted container registries.

Hunting Queries:

• Search for containerd logs containing "unpack" and "error".
• Monitor for new files in /etc/cron.d/ or /etc/ld.so.preload.

Indicators of Compromise (IOCs)

• File System Changes: Unexpected files in /etc/cron.d/, /etc/ld.so.preload, /root/.ssh/authorized_keys.
• Process Anomalies: Unusual processes spawned by containerd or the container runtime.
• Network Connections: Outbound connections from the host to unknown IPs/domains.
• containerd Logs: Entries indicating failed or suspicious image unpacking operations.
• Image Hashes: SHA256 hashes of known malicious images (if available).

Detection Engineering

YARA Rule

rule CVE_2025_47290_TOCTOU_Containerd {
    meta:
        description = "Detects malicious container images exploiting CVE-2025-47290"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-47290"
    strings:
        $symlink = /symlink/i
        $unpack = /unpack/i
        $layer = /layer/i
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-47290 - TOCTOU in containerd Image Unpacking
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-47290 via containerd logs
author: Valters IT
date: 2025-01-01
logsource:
    product: linux
    service: containerd
detection:
    selection:
        EventID: 1000
        Message|contains: 'unpack'
    condition: selection
falsepositives:
    - Legitimate image pulls
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-47290 - Potential TOCTOU Exploit in containerd"; flow:to_server; content:"|2e 2e 2f|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade containerd to version 2.1.1 or later.
2. Workaround: Only pull images from trusted registries and restrict image import permissions to trusted users.
3. Isolation: Use container runtime security features (e.g., AppArmor, SELinux) to limit the impact of a compromise.

Long-Term Measures:

1. Image Signing: Implement image signing and verification (e.g., Docker Content Trust, Notary).
2. Registry Security: Use a private registry with access controls and vulnerability scanning.
3. Runtime Security: Deploy runtime security tools (e.g., Falco, Tracee) to detect anomalous behavior.
4. Regular Updates: Keep containerd and all container runtime components up to date.

Valters IT Signature:

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert