Skip to content
OpenAdvisories
Medium USN-7374-1 1 CVE

containerd vulnerability

Published Mar 26, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Benjamin Koltermann discovered that containerd incorrectly handled large
user id values. This could result in containers possibly being run as root,
contrary to expectations.

Fixed packages 8

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS containerd 1.6.12-0ubuntu1~20.04.8
Ubuntu · 20.04 LTS 20.04:LTS containerd-app 1.7.24-0ubuntu1~20.04.2
Ubuntu · 22.04 LTS 22.04:LTS containerd 1.6.12-0ubuntu1~22.04.8
Ubuntu · 22.04 LTS 22.04:LTS containerd-app 1.7.24-0ubuntu1~22.04.2
Ubuntu · 24.04 LTS 24.04:LTS containerd-app 1.7.24-0ubuntu1~24.04.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS containerd 1.2.6-0ubuntu1~16.04.6+esm5
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS containerd 1.6.12-0ubuntu1~18.04.1+esm2
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS containerd 1.6.24~ds1-1ubuntu1.2+esm1

Vulnerabilities 1

  • Medium 4.6
    CVE-2024-40635 Public exploit

    containerd has an integer overflow in User ID handling

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition wh…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2024-40635