CVE-2024-40635: containerd has an integer overflow in User ID handling
(updated )
A bug was found in containerd where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.
References
- github.com/advisories/GHSA-265r-hfxg-fhmg
- github.com/containerd/containerd
- github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da
- github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
- github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
- github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg
- lists.debian.org/debian-lts-announce/2025/05/msg00005.html
- nvd.nist.gov/vuln/detail/CVE-2024-40635
Code Behaviors & Features
Detect and mitigate CVE-2024-40635 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →