containerd User ID Bypass Allows runAsNonRoot Evasion via UID 0 Mapping (CVE-2024-45600)

Vulnerability Overview Title: containerd user ID handling bypass allows runAsNonRoot evasion Description: A vulnerability was discovered in containerd where containers started with a numeric user directive are incorrectly treated as usernames if the directive cannot be parsed as a 32-bit integer. If a crafted image provides an file that maps this large number to root, the container will ultimately run as root (UID 0). This allows an evasion of Kubernetes' restriction, leading to unexpected behavior in environments that require containers to run as non-root users. Affected Versions Affected Versions: - : >= 1.7.27 - : >= 2.0.4 Fixed Versions: - 1.7.32 - 2.0.9, 2.2.4, 2.3.1 Remediation Patch: - This vulnerability has been fixed in the following containerd versions: - 2.3.1 - 2.2.4 - 2.0.9 - 1.7.32 Note: containerd version 2.1 has reached its end of life, and no fix version was provided. Users should update to the versions listed above to resolve this issue. Workarounds Ensure that only trusted images are used and only trusted users have the right to import images. Alternatively, enforce specific numeric in the Kubernetes Pod security context, overriding the directive in the image to prevent bypass. Starting with Kubernetes 1.34, newer versions of Kubernetes also appear to enforce , regardless of this vulnerability. References CVE ID: CVE-2024-45600 GHSA: GHSA-2h5g-8hmg (CVE-2024-45635) Additional Information For any questions or comments, please contact via: - Open an issue in containerd - Send an email to security@containerd.io To report new vulnerabilities: - Send an email to security@containerd.io

Goal Reached Thanks to every supporter — we hit 100%!

containerd User ID Bypass Allows runAsNonRoot Evasion via UID 0 Mapping (CVE-2024-45600)

More from this source