A vulnerability in containerd allows local users to leverage incorrect file system permissions to potentially gain unauthorized access or escalate privileges on the host system.

This flaw involves CWE-279, where critical directory paths are created with insecure permissions that are group or world accessible. This allows a local authenticated user with low privileges to interact with these paths, which may lead to total system impact.

The vulnerability carries a CVSS score of 7.3, reflecting its potential for high impact on confidentiality, integrity, and availability. By exploiting these overly broad permissions, a malicious actor could compromise the container runtime environment, leading to unauthorized host access or the disruption of containerized services, which can result in significant operational downtime.

Immediate Action: Update containerd to versions 1.7.29, 2.0.7, 2.1.5, or 2.2.0 as appropriate for your environment.

Proactive Monitoring: Monitor system logs for unauthorized access attempts to the directories /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim.

Compensating Controls: If patching is not immediately feasible, system administrators can manually change directory permissions using chmod to restrict access or configure containerd to run in rootless mode to mitigate the risk.

Public Exploit Available: Unknown

Given the potential for high-impact compromise, organizations should prioritize updating their containerd instances to the fixed versions. If immediate updates are not possible, implementing the suggested manual permission hardening is essential to prevent local privilege escalation.