containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

The version of containerd / containerd2 / moby-containerd / moby-containerd-cc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-40635 advisory.

  - containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd / containerd2 / moby-containerd / moby-containerd-cc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-40635 advisory.

  - containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4153 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4153-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     May 04, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : containerd     Version        : 1.4.13~ds1-1~deb11u5     CVE ID         : CVE-2024-40635     Debian Bug     : 1100806

    containerd is a container runtime. A bug was found in containerd     where containers launched with a User set as a `UID:GID` larger than the     maximum 32-bit signed integer can cause an overflow condition where the     container ultimately runs as root (UID 0). This could cause unexpected behavior     for environments that require containers to run as a non-root user.

    For Debian 11 bullseye, this problem has been fixed in version     1.4.13~ds1-1~deb11u5.

    We recommend that you upgrade your containerd packages.

    For the detailed security status of containerd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/containerd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-056 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1345-1 advisory.

    - CVE-2024-40635: Fixed integer overflow in User ID handling (bsc#1239749)

    Other fixes:
    - Update to containerd v1.7.27.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1346-1 advisory.

    - CVE-2024-40635: Fixed integer overflow in User ID handling (bsc#1239749)

    Other fixes:
    - Update to containerd v1.7.27.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-051 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-054 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-920 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-92362585e0 advisory.

    Update to v1.7.27 for F41

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7374-1 advisory.

    Benjamin Koltermann discovered that containerd incorrectly handled large user id values. This could result     in containers possibly being run as root, contrary to expectations.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
235300	Azure Linux 3.0 Security Update: containerd / containerd2 / moby-containerd / moby-containerd-cc (CVE-2024-40635)	Nessus	Azure Linux Local Security Checks	medium
235228	CBL Mariner 2.0 Security Update: containerd / containerd2 / moby-containerd / moby-containerd-cc (CVE-2024-40635)	Nessus	MarinerOS Local Security Checks	medium
235113	Debian dla-4153 : containerd - security update	Nessus	Debian Local Security Checks	medium
234961	Amazon Linux 2 : containerd (ALASECS-2025-056)	Nessus	Amazon Linux Local Security Checks	medium
234611	SUSE SLES15 / openSUSE 15 Security Update : containerd (SUSE-SU-2025:1345-1)	Nessus	SuSE Local Security Checks	medium
234604	SUSE SLES12 Security Update : containerd (SUSE-SU-2025:1346-1)	Nessus	SuSE Local Security Checks	medium
233698	Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-051)	Nessus	Amazon Linux Local Security Checks	medium
233696	Amazon Linux 2 : containerd (ALASDOCKER-2025-054)	Nessus	Amazon Linux Local Security Checks	medium
233689	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-920)	Nessus	Amazon Linux Local Security Checks	medium
233476	Fedora 41 : containerd (2025-92362585e0)	Nessus	Fedora Local Security Checks	medium
233370	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : containerd vulnerability (USN-7374-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-40635

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium