Integer Overflow or Wraparound Affecting containerd-debuginfo package, versions <0:1.7.27-1.amzn2023.0.1


Severity

Recommended
0.0
medium
0
10

Based on Amazon Linux security rating.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-CONTAINERDDEBUGINFO-9598903
  • published2 Apr 2025
  • disclosed17 Mar 2025

Introduced: 17 Mar 2025

NewCVE-2024-40635  (opens in a new tab)
CWE-190  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 containerd-debuginfo to version 0:1.7.27-1.amzn2023.0.1 or higher.
This issue was patched in ALAS2023-2025-920.

NVD Description

Note: Versions mentioned in the description apply only to the upstream containerd-debuginfo package and not the containerd-debuginfo package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

CVSS Base Scores

version 3.1