CVE-2024-40635
Fixed in a distro release EPSS <1%CVSS 4.6
containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.7.27 |
| Go | github.com/containerd/containerd | 1.6.38 |
| Go | github.com/containerd/containerd/v2 | 2.0.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | containerd | 1.7.27-1.amzn2023.0.1 |
| Amazon Linux 2023 | containerd-stress | 1.7.27-1.amzn2023.0.1 |
| Amazon Linux 2023 | docker | 25.0.8-1.amzn2023.0.4 |
| Amazon Linux 2023 | ecs-init | 1.93.1-1.amzn2023 |
| Chainguard | auditbeat-7 | 7.17.28-r7 |
| Chainguard | auditbeat-7-oci-entrypoint | 7.17.28-r7 |
| Chainguard | auditbeat-fips-7 | 7.17.28-r5 |
| Chainguard | beats-7 | 7.17.28-r7 |
| Chainguard | beats-fips-7 | 7.17.28-r5 |
| Chainguard | buildctl | 0.20.1-r3 |
| Chainguard | buildctl-fips | 0.20.1-r3 |
| Chainguard | buildkitd | 0.20.1-r3 |
| Chainguard | buildkitd-fips | 0.20.1-r3 |
| Chainguard | cert-manager-cmctl | 2.1.1-r9 |
| Chainguard | cert-manager-cmctl-fips | 2.1.1-r9 |
| Chainguard | chainctl | 0.2.59-r0 |
| Chainguard | chartmuseum | 0.16.2-r15 |
| Chainguard | cilium-cli | 0.18.2-r2 |
| Chainguard | cluster-api-helm-controller | 0.3.2-r2 |
| Chainguard | cluster-api-helm-controller-compat | 0.3.2-r2 |
| Chainguard | cluster-api-helm-controller-fips | 0.3.2-r2 |
| Chainguard | cluster-api-helm-controller-fips-compat | 0.3.2-r2 |
| Chainguard | consul-k8s-1.1 | 1.1.18-r9 |
| Chainguard | consul-k8s-1.1-cli | 1.1.18-r9 |
| Chainguard | consul-k8s-1.3 | 1.3.9-r10 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r10 |
| Chainguard | consul-k8s-1.4 | 1.4.8-r9 |
| Chainguard | consul-k8s-1.4-cli | 1.4.8-r9 |
| Chainguard | consul-k8s-1.5 | 1.5.5-r7 |
| Chainguard | consul-k8s-1.5-cli | 1.5.5-r7 |
| Chainguard | consul-k8s-1.6 | 1.6.2-r9 |
| Chainguard | consul-k8s-1.6-cli | 1.6.2-r9 |
| Chainguard | consul-k8s-fips-1.1 | 1.1.18-r8 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r8 |
| Chainguard | consul-k8s-fips-1.3 | 1.3.9-r9 |
| Chainguard | consul-k8s-fips-1.3-cli | 1.3.9-r9 |
| Chainguard | consul-k8s-fips-1.4 | 1.4.8-r10 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.8-r10 |
| Chainguard | consul-k8s-fips-1.5 | 1.5.5-r9 |
| Chainguard | consul-k8s-fips-1.5-cli | 1.5.5-r9 |
| Chainguard | consul-k8s-fips-1.6 | 1.6.2-r8 |
| Chainguard | consul-k8s-fips-1.6-cli | 1.6.2-r8 |
| Chainguard | ctop | 0.7.7-r23 |
| Chainguard | dagger | 0.16.3-r1 |
| Chainguard | docker-cli-buildx | 0.21.3-r1 |
| Chainguard | docker-cli-buildx-fips | 0.22.0-r0 |
| Chainguard | docker-compose | 2.34.0-r1 |
| Chainguard | docker-compose-fips | 2.34.0-r2 |
| Chainguard | docker-config-mirror-gcr | 28.0.2-r0 |
| Chainguard | docker-credential-cgr | 0.2.59-r0 |
| Chainguard | docker-dind | 28.0.2-r0 |
| Chainguard | eksctl | 0.205.0-r4 |
| Chainguard | envoy-gateway | 1.3.1-r2 |
| Chainguard | envoy-gateway-compat | 1.3.1-r2 |
| Chainguard | envoy-gateway-egctl | 1.3.1-r2 |
| Chainguard | envoy-gateway-fips | 1.3.1-r2 |
| Chainguard | envoy-gateway-fips-egctl | 1.3.1-r2 |
| Chainguard | filebeat-7 | 7.17.28-r7 |
| Chainguard | filebeat-7-oci-entrypoint | 7.17.28-r7 |
| Chainguard | filebeat-fips-7 | 7.17.28-r5 |
| Chainguard | flux-helm-controller | 1.2.0-r4 |
| Chainguard | flux-helm-controller-fips | 1.2.0-r4 |
| Chainguard | flux-helm-controller-iamguarded-compat | 1.2.0-r4 |
| Chainguard | flux-source-controller | 1.5.0-r7 |
| Chainguard | flux-source-controller-fips | 1.5.0-r6 |
| Chainguard | flux-source-controller-iamguarded-compat | 1.5.0-r7 |
| Chainguard | fuse-overlayfs-snapshotter | 2.1.2-r0 |
| Chainguard | grype | 0.90.0-r1 |
| Chainguard | grype-db | 0.29.0-r3 |
| Chainguard | grype-db-manager | 0.29.0-r3 |
| Chainguard | grype-fips | 0.90.0-r1 |
| Chainguard | heartbeat-7 | 7.17.28-r7 |
| Chainguard | heartbeat-7-oci-entrypoint | 7.17.28-r7 |
| Chainguard | heartbeat-fips-7 | 7.17.28-r5 |
| Chainguard | heartbeat-fips-7-oci-entrypoint | 7.17.28-r5 |
| Chainguard | helm | 3.17.2-r1 |
| Chainguard | helm-3 | 3.19.2-r1 |
| Chainguard | helm-4 | 4.0.1-r1 |
| Chainguard | helm-fips | 3.17.2-r1 |
| Chainguard | helm-fips-3 | 3.19.2-r0 |
| Chainguard | helm-fips-4 | 4.0.1-r1 |
| Chainguard | helm-operator | 1.39.1-r6 |
| Chainguard | helm-operator-compat | 1.39.1-r6 |
| Chainguard | helm-operator-fips | 1.39.1-r6 |
| Chainguard | helm-operator-fips-compat | 1.39.1-r6 |
| Chainguard | helm-push | 0.10.4-r27 |
| Chainguard | k3s-1.31 | 1.31.6.1-r7 |
| Chainguard | k3s-1.31 | 1.31.6.1-r16 |
| Chainguard | k3s-static | 1.34.1.1-r2 |
| Chainguard | k3s-static-1.31 | 1.31.6.1-r16 |
| Chainguard | k8sgpt | 0.4.1-r1 |
| Chainguard | k8ssandra-client | 0.6.1-r1 |
| Chainguard | k8ssandra-client-compat | 0.6.1-r1 |
| Chainguard | k8ssandra-client-fips | 0.6.1-r1 |
| Chainguard | kaniko | 1.23.2-r14 |
| Chainguard | kaniko-compat | 1.23.2-r14 |
| Chainguard | kaniko-fips | 1.23.2-r10 |
| Chainguard | kaniko-warmer | 1.23.2-r14 |
| Chainguard | kaniko-warmer-compat | 1.23.2-r14 |
| Chainguard | kaniko-warmer-fips | 1.23.2-r10 |
| Chainguard | kargo | 1.3.1-r3 |
| Chainguard | kargo-oci-compat | 1.3.1-r3 |
| Chainguard | kots | 1.124.7-r1 |
| Chainguard | kots-compat | 1.124.7-r1 |
| Chainguard | kots-symlink-compat | 1.124.7-r1 |
| Chainguard | kubescape | 3.0.32-r1 |
| Chainguard | kubevela | 1.10.2-r4 |
| Chainguard | kubevela-vela-cli | 1.10.2-r4 |
| Chainguard | kubevela-vela-core | 1.10.2-r4 |
| Chainguard | kubevela-vela-core-compat | 1.10.2-r4 |
| Chainguard | linkerd2 | 25.3.3-r0 |
| Chainguard | linkerd2-cli | 25.3.3-r0 |
| Chainguard | linkerd2-controller | 25.3.3-r0 |
| Chainguard | linkerd2-controller-compat | 25.3.3-r0 |
| Chainguard | linkerd2-debug | 25.3.3-r0 |
| Chainguard | linkerd2-metrics-api | 25.3.3-r0 |
| Chainguard | linkerd2-metrics-api-compat | 25.3.3-r0 |
| Chainguard | linkerd2-proxy-identity | 25.3.3-r0 |
| Chainguard | linkerd2-tap | 25.3.3-r0 |
| Chainguard | linkerd2-tap-compat | 25.3.3-r0 |
| Chainguard | linkerd2-web | 25.3.3-r0 |
| Chainguard | melange | 0.23.0-r1 |
| Chainguard | metricbeat-7 | 7.17.28-r7 |
| Chainguard | metricbeat-7-oci-entrypoint | 7.17.28-r7 |
| Chainguard | metricbeat-fips-7 | 7.17.28-r5 |
| Chainguard | nerdctl | 2.0.3-r5 |
| Chainguard | neuvector | 5.4.3-r0 |
| Chainguard | neuvector-cis-benchmarks | 5.4.3-r0 |
| Chainguard | neuvector-controller | 5.4.3-r0 |
| Chainguard | neuvector-controller-fips | 5.4.2-r7 |
| Chainguard | neuvector-enforcer | 5.4.3-r0 |
| Chainguard | neuvector-enforcer-fips | 5.4.2-r7 |
| Chainguard | neuvector-fips | 5.4.2-r7 |
| Chainguard | neuvector-monitor | 5.4.3-r0 |
| Chainguard | neuvector-nstools | 5.4.3-r0 |
| Chainguard | neuvector-scanner | 3.788-r0 |
| Chainguard | neuvector-scanner-fips | 0_git20240528-r8 |
| Chainguard | neuvector-scanner-monitor | 3.788-r0 |
| Chainguard | neuvector-scanner-task | 3.788-r0 |
| Chainguard | neuvector-scanner-task-fips | 0_git20240528-r8 |
| Chainguard | neuvector-upgrader | 5.4.3-r0 |
| Chainguard | neuvector-upgrader-fips | 5.4.2-r7 |
| Chainguard | newrelic-infrastructure-agent | 1.62.0-r3 |
| Chainguard | opa | 1.2.0-r2 |
| Chainguard | opa-envoy | 1.2.0_p2-r2 |
| Chainguard | opa-fips | 1.2.0-r2 |
| Chainguard | opa-fips-envoy | 1.2.0_p2-r2 |
| Chainguard | osv-scanner | 2.0.0-r1 |
| Chainguard | rancher-2.10 | 2.10.10-r3 |
| Chainguard | rancher-2.10 | 2.10.11-r5 |
| Chainguard | rancher-2.11 | 2.11.15-r4 |
| Chainguard | rancher-agent-2.10 | 2.10.3-r9 |
| Chainguard | rancher-agent-2.11 | 0 |
| Chainguard | rancher-agent-2.9 | 2.9.7-r4 |
| Chainguard | rancher-fleet | 0.11.5-r3 |
| Chainguard | rancher-fleet-agent | 0.11.5-r3 |
| Chainguard | rancher-fleet-agent-fips | 0.11.5-r1 |
| Chainguard | rancher-fleet-cli | 0.11.5-r3 |
| Chainguard | rancher-fleet-cli-fips | 0.11.5-r1 |
| Chainguard | rancher-fleet-controller | 0.11.5-r3 |
| Chainguard | rancher-fleet-controller-fips | 0.11.5-r1 |
| Chainguard | rancher-fleet-fips | 0.11.5-r1 |
| Chainguard | rancher-fleet-termination-log | 0.11.5-r3 |
| Chainguard | skaffold | 2.14.1-r6 |
| Chainguard | spegel | 0.0.30-r5 |
| Chainguard | spegel-compat | 0.0.30-r5 |
| Chainguard | syft | 1.21.0-r1 |
| Chainguard | syft-fips | 1.21.0-r0 |
| Chainguard | trivy | 0.60.0-r4 |
| Chainguard | trivy-fips | 0.60.0-r4 |
| Chainguard | wolfictl | 0.31.1-r1 |
| Chainguard | xeol | 0.10.8-r4 |
| Chainguard | xeol-compat | 0.10.8-r4 |
| Chainguard | xeol-fips | 0.10.8-r4 |
| Chainguard | zarf | 0.49.1-r3 |
| Chainguard | zot | 2.1.2-r7 |
| Debian 11 | containerd | 1.4.13~ds1-1~deb11u5 |
| Debian 12 | containerd | 1.6.20~ds1-1+deb12u2 |
| Debian 13 | containerd | 1.7.24~ds1-6 |
| Debian 14 | containerd | 1.7.24~ds1-6 |
| SUSE Linux Enterprise Micro 5.1 | containerd | 1.7.27-150000.123.1 |
| SUSE Linux Enterprise Micro 5.2 | containerd | 1.7.27-150000.123.1 |
| SUSE Linux Enterprise Micro 5.3 | containerd | 1.7.27-150000.123.1 |
| SUSE Linux Enterprise Micro 5.4 | containerd | 1.7.27-150000.123.1 |
| SUSE Linux Enterprise Micro 5.5 | containerd | 1.7.27-150000.123.1 |
| SUSE Linux Enterprise Module for Containers 15 SP6 | containerd | 1.7.27-150000.123.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | containerd | 1.7.27-16.100.1 |
| SUSE Linux Micro 6.0 | containerd | 1.7.27-1.1 |
| SUSE Linux Micro 6.1 | containerd | 1.7.27-slfo.1.1_1.1 |
| Ubuntu 20.04 LTS | containerd | 1.6.12-0ubuntu1~20.04.8 |
| Ubuntu 20.04 LTS | containerd-app | 1.7.24-0ubuntu1~20.04.2 |
| Ubuntu 22.04 LTS | containerd | 1.6.12-0ubuntu1~22.04.8 |
| Ubuntu 22.04 LTS | containerd-app | 1.7.24-0ubuntu1~22.04.2 |
| Ubuntu 24.04 LTS | containerd-app | 1.7.24-0ubuntu1~24.04.2 |
| Ubuntu 25.10 | containerd-app | 2.0.2-0ubuntu2 |
| Ubuntu Pro 16.04 LTS | containerd | 1.2.6-0ubuntu1~16.04.6+esm5 |
| Ubuntu Pro 18.04 LTS | containerd | 1.6.12-0ubuntu1~18.04.1+esm2 |
| Ubuntu Pro 24.04 LTS | containerd | 1.6.24~ds1-1ubuntu1.2+esm1 |
| Wolfi | buildctl | 0.20.1-r3 |
| Wolfi | buildkitd | 0.20.1-r3 |
| Wolfi | cert-manager-cmctl | 2.1.1-r9 |
| Wolfi | chartmuseum | 0.16.2-r15 |
| Wolfi | cilium-cli | 0.18.2-r2 |
| Wolfi | cluster-api-helm-controller | 0.3.2-r2 |
| Wolfi | cluster-api-helm-controller-compat | 0.3.2-r2 |
| Wolfi | ctop | 0.7.7-r23 |
| Wolfi | dagger | 0.16.3-r1 |
| Wolfi | docker-cli-buildx | 0.21.3-r1 |
| Wolfi | docker-compose | 2.34.0-r1 |
| Wolfi | docker-config-mirror-gcr | 28.0.2-r0 |
| Wolfi | docker-dind | 28.0.2-r0 |
| Wolfi | eksctl | 0.205.0-r4 |
| Wolfi | envoy-gateway | 1.3.1-r2 |
| Wolfi | envoy-gateway-compat | 1.3.1-r2 |
| Wolfi | envoy-gateway-egctl | 1.3.1-r2 |
| Wolfi | flux-helm-controller | 1.2.0-r4 |
| Wolfi | flux-helm-controller-iamguarded-compat | 1.2.0-r4 |
| Wolfi | flux-source-controller | 1.5.0-r7 |
| Wolfi | flux-source-controller-iamguarded-compat | 1.5.0-r7 |
| Wolfi | fuse-overlayfs-snapshotter | 2.1.2-r0 |
| Wolfi | grype | 0.90.0-r1 |
| Wolfi | helm | 3.17.2-r1 |
| Wolfi | helm-3 | 3.19.2-r1 |
| Wolfi | helm-4 | 4.0.1-r1 |
| Wolfi | helm-operator | 1.39.1-r6 |
| Wolfi | helm-operator-compat | 1.39.1-r6 |
| Wolfi | helm-push | 0.10.4-r27 |
| Wolfi | k3s-static | 1.34.1.1-r2 |
| Wolfi | k8sgpt | 0.4.1-r1 |
| Wolfi | k8ssandra-client | 0.6.1-r1 |
| Wolfi | k8ssandra-client-compat | 0.6.1-r1 |
| Wolfi | kaniko | 1.23.2-r14 |
| Wolfi | kaniko-compat | 1.23.2-r14 |
| Wolfi | kaniko-warmer | 1.23.2-r14 |
| Wolfi | kaniko-warmer-compat | 1.23.2-r14 |
| Wolfi | kargo | 1.3.1-r3 |
| Wolfi | kargo-oci-compat | 1.3.1-r3 |
| Wolfi | kots | 1.124.7-r1 |
| Wolfi | kots-compat | 1.124.7-r1 |
| Wolfi | kots-symlink-compat | 1.124.7-r1 |
| Wolfi | kubescape | 3.0.32-r1 |
| Wolfi | kubevela | 1.10.2-r4 |
| Wolfi | kubevela-vela-cli | 1.10.2-r4 |
| Wolfi | kubevela-vela-core | 1.10.2-r4 |
| Wolfi | kubevela-vela-core-compat | 1.10.2-r4 |
| Wolfi | linkerd2 | 25.3.3-r0 |
| Wolfi | linkerd2-cli | 25.3.3-r0 |
| Wolfi | linkerd2-controller | 25.3.3-r0 |
| Wolfi | linkerd2-controller-compat | 25.3.3-r0 |
| Wolfi | linkerd2-debug | 25.3.3-r0 |
| Wolfi | linkerd2-metrics-api | 25.3.3-r0 |
| Wolfi | linkerd2-metrics-api-compat | 25.3.3-r0 |
| Wolfi | linkerd2-proxy-identity | 25.3.3-r0 |
| Wolfi | linkerd2-tap | 25.3.3-r0 |
| Wolfi | linkerd2-tap-compat | 25.3.3-r0 |
| Wolfi | linkerd2-web | 25.3.3-r0 |
| Wolfi | melange | 0.23.0-r1 |
| Wolfi | nerdctl | 2.0.3-r5 |
| Wolfi | neuvector-scanner | 3.788-r0 |
| Wolfi | neuvector-scanner-monitor | 3.788-r0 |
| Wolfi | neuvector-scanner-task | 3.788-r0 |
| Wolfi | newrelic-infrastructure-agent | 1.62.0-r3 |
| Wolfi | opa | 1.2.0-r2 |
| Wolfi | opa-envoy | 1.2.0_p2-r2 |
| Wolfi | osv-scanner | 2.0.0-r1 |
| Wolfi | rancher-fleet | 0.11.5-r3 |
| Wolfi | rancher-fleet-agent | 0.11.5-r3 |
| Wolfi | rancher-fleet-cli | 0.11.5-r3 |
| Wolfi | rancher-fleet-controller | 0.11.5-r3 |
| Wolfi | rancher-fleet-termination-log | 0.11.5-r3 |
| Wolfi | skaffold | 2.14.1-r6 |
| Wolfi | spegel | 0.0.30-r5 |
| Wolfi | spegel-compat | 0.0.30-r5 |
| Wolfi | syft | 1.21.0-r1 |
| Wolfi | trivy | 0.60.0-r4 |
| Wolfi | wolfictl | 0.31.1-r1 |
| Wolfi | xeol | 0.10.8-r4 |
| Wolfi | xeol-compat | 0.10.8-r4 |
| Wolfi | zarf | 0.49.1-r3 |
| Wolfi | zot | 2.1.2-r7 |
| openSUSE Leap 15.6 | containerd | 1.7.27-150000.123.1 |
| openSUSE Tumbleweed | cmctl | 2.2.0-1.1 |
| openSUSE Tumbleweed | containerd | 1.7.27-1.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250318T181448-1.1 |