Description
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| edgelesssys | contrast | 1.8.0 – < 1.24.1 | 1.24.1 |