Integer Overflow or Wraparound Affecting containerd-app package, versions <1.7.24-0ubuntu1~24.04.2


Severity

Recommended
medium

Based on Ubuntu security rating.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2404-CONTAINERDAPP-9485821
  • published27 Mar 2025
  • disclosed17 Mar 2025

Introduced: 17 Mar 2025

NewCVE-2024-40635  (opens in a new tab)
CWE-190  (opens in a new tab)

How to fix?

Upgrade Ubuntu:24.04 containerd-app to version 1.7.24-0ubuntu1~24.04.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream containerd-app package and not the containerd-app package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

CVSS Base Scores

version 3.1