containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

vendor_unpatched cve-2024-40635: Unpatched CVEs for Debian Linux (cve-2024-40635)

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-051 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-054 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-920 advisory.

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38,     1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit     signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This     could cause unexpected behavior for environments that require containers to run as a non-root user. This     bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted     images are used and that only trusted users have permissions to import images. (CVE-2024-40635)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-92362585e0 advisory.

    Update to v1.7.27 for F41

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7374-1 advisory.

    Benjamin Koltermann discovered that containerd incorrectly handled large user id values. This could result     in containers possibly being run as root, contrary to expectations.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233698	Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-051)	Nessus	Amazon Linux Local Security Checks	medium
233696	Amazon Linux 2 : containerd (ALASDOCKER-2025-054)	Nessus	Amazon Linux Local Security Checks	medium
233689	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-920)	Nessus	Amazon Linux Local Security Checks	medium
233476	Fedora 41 : containerd (2025-92362585e0)	Nessus	Fedora Local Security Checks	medium
233370	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : containerd vulnerability (USN-7374-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-40635

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium