Skip to content

chore(deps): update module github.com/containerd/containerd to v1.7.29 [security] - autoclosed - #2133

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-containerd-containerd-vulnerability
Closed

chore(deps): update module github.com/containerd/containerd to v1.7.29 [security] - autoclosed#2133
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-containerd-containerd-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Nov 11, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/containerd/containerd v1.7.28 -> v1.7.29 age confidence

GitHub Vulnerability Alerts

CVE-2024-25621

Impact

An overly broad default permission vulnerability was found in containerd.

  • /var/lib/containerd was created with the permission bits 0o711, while it should be created with 0o700
    • Allowed local users on the host to potentially access the metadata store and the content store
  • /run/containerd/io.containerd.grpc.v1.cri was created with 0o755, while it should be created with 0o700
    • Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
  • /run/containerd/io.containerd.sandbox.controller.v1.shim was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the temp directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.

Patches

This bug has been fixed in the following containerd versions:

  • 2.2.0
  • 2.1.5
  • 2.0.7
  • 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing directories.

Note

/run/containerd and /run/containerd/io.containerd.runtime.v2.task are still created with 0o711.
This is an expected behavior for supporting userns-remapped containers.

Workarounds

The system administrator on the host can manually chmod the directories to not
have group or world accessible permisisons:

chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim

An alternative mitigation would be to run containerd in rootless mode.

Credits

The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

To report a security issue in containerd:

CVE-2025-64329

Impact

A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., kubectl attach) could increase the memory usage of containerd.

Patches

This bug has been fixed in the following containerd versions:

  • 2.2.0
  • 2.1.5
  • 2.0.7
  • 1.7.29

Users should update to these versions to resolve the issue.

Workarounds

Set up an admission controller to control accesses to pods/attach resources.
e.g., Validating Admission Policy.

Credits

The containerd project would like to thank @​Wheat2018 for responsibly disclosing this issue in accordance with the containerd security policy.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

For more information

If you have any questions or comments about this advisory:

To report a security issue in containerd:

containerd CRI server: Host memory exhaustion through Attach goroutine leak

CVE-2025-64329 / GHSA-m6hq-p25p-ffr2 / GO-2025-4108

More information

Details

Impact

A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., kubectl attach) could increase the memory usage of containerd.

Patches

This bug has been fixed in the following containerd versions:

  • 2.2.0
  • 2.1.5
  • 2.0.7
  • 1.7.29

Users should update to these versions to resolve the issue.

Workarounds

Set up an admission controller to control accesses to pods/attach resources.
e.g., Validating Admission Policy.

Credits

The containerd project would like to thank @​Wheat2018 for responsibly disclosing this issue in accordance with the containerd security policy.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

For more information

If you have any questions or comments about this advisory:

To report a security issue in containerd:

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

containerd affected by a local privilege escalation via wide permissions on CRI directory

CVE-2024-25621 / GHSA-pwhc-rpq9-4c8w / GO-2025-4100

More information

Details

Impact

An overly broad default permission vulnerability was found in containerd.

  • /var/lib/containerd was created with the permission bits 0o711, while it should be created with 0o700
    • Allowed local users on the host to potentially access the metadata store and the content store
  • /run/containerd/io.containerd.grpc.v1.cri was created with 0o755, while it should be created with 0o700
    • Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
  • /run/containerd/io.containerd.sandbox.controller.v1.shim was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the temp directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.

Patches

This bug has been fixed in the following containerd versions:

  • 2.2.0
  • 2.1.5
  • 2.0.7
  • 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing directories.

[!NOTE]

/run/containerd and /run/containerd/io.containerd.runtime.v2.task are still created with 0o711.
This is an expected behavior for supporting userns-remapped containers.

Workarounds

The system administrator on the host can manually chmod the directories to not
have group or world accessible permisisons:

chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim

An alternative mitigation would be to run containerd in rootless mode.

Credits

The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

To report a security issue in containerd:

Severity

  • CVSS Score: 7.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd

CVE-2025-64329 / GHSA-m6hq-p25p-ffr2 / GO-2025-4108

More information

Details

containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd

CVE-2024-25621 / GHSA-pwhc-rpq9-4c8w / GO-2025-4100

More information

Details

containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

containerd/containerd (github.com/containerd/containerd)

v1.7.29: containerd 1.7.29

Compare Source

Welcome to the v1.7.29 release of containerd!

The twenty-ninth patch release for containerd 1.7 contains various fixes
and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Update differ to handle zstd media types (#​12018)
Runtime
  • Update runc binary to v1.3.3 (#​12480)
  • Fix lost container logs from quickly closing io (#​12375)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors
  • Derek McGowan
  • Akihiro Suda
  • Phil Estes
  • Austin Vazquez
  • Sebastiaan van Stijn
  • ningmingxiao
  • Maksym Pavlenko
  • StepSecurity Bot
  • wheat2018
Changes
38 commits

  • 442cb34bd Merge commit from fork
  • 0450f046e Fix directory permissions
  • e5cb6ddb7 Merge commit from fork
  • c575d1b5f fix goroutine leak of container Attach
  • Prepare release notes for v1.7.29 (#​12486)
    • 1fc2daaf3 Prepare release notes for v1.7.29
  • Update runc binary to v1.3.3 (#​12480)
    • 3f5f9f872 runc: Update runc binary to v1.3.3
  • Update GHA images and bump Go 1.24.9; 1.25.3 (#​12471)
    • 667409fb6 ci: bump Go 1.24.9, 1.25.3
    • 294f8c027 Update GHA runners to use latest images for basic binaries build
    • cf66b4141 Update GHA runners to use latest image for most jobs
    • fa3e6fa18 pkg/epoch: extract parsing SOURCE_DATE_EPOCH to a function
    • ac334bffc pkg/epoch: fix tests on macOS
    • d04b8721f pkg/epoch: replace some fmt.Sprintfs with strconv
  • CI: update Fedora to 43 (#​12450)
  • CI: skip ubuntu-24.04-arm on private repos (#​12429)
    • cf99a012d CI: skip ubuntu-24.04-arm on private repos
  • runc:Update runc binary to v1.3.1 (#​12276)
    • 4c77b8d07 runc:Update runc binary to v1.3.1
  • Fix lost container logs from quickly closing io (#​12375)
    • d30024db2 bugfix:fix container logs lost because io close too quickly
  • ci: bump Go 1.24.8 (#​12362)
    • f4b3d96f3 ci: bump Go 1.24.8
    • 334fd8e4b update golangci-lint to v1.64.2
    • 8a67abc4c Drop inactivated linter exportloopref
    • e4dbf08f0 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
    • d7db2ba06 build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
    • d7182888f build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
    • 4be6c7e3b build(deps): bump actions/cache from 4.1.2 to 4.2.0
    • a2e097e86 build(deps): bump actions/checkout from 4.2.1 to 4.2.2
    • 6de404d11 build(deps): bump actions/cache from 4.1.1 to 4.1.2
    • 038a25584 [StepSecurity] ci: Harden GitHub Actions
  • Update differ to handle zstd media types (#​12018)
    • eaeb4b6ac Update differ to handle zstd media types
  • ci: bump Go 1.23.12, 1.24.6 (#​12188)

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.7.28

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Nov 11, 2025
@renovate

renovate Bot commented Nov 11, 2025

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: e2e/go.sum
Command failed: install-tool golang 1.24.10

@renovate renovate Bot changed the title chore(deps): update module github.com/containerd/containerd to v1.7.29 [security] chore(deps): update module github.com/containerd/containerd to v1.7.29 [security] - autoclosed Nov 19, 2025
@renovate renovate Bot closed this Nov 19, 2025
@renovate
renovate Bot deleted the renovate/go-github.com-containerd-containerd-vulnerability branch November 19, 2025 15:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants