CVE-2024-25621 containerd 默认目录权限过宽导致权限提升漏洞

#!/bin/bash # CVE-2024-25621 PoC - containerd Permission Vulnerability # Check if containerd directories have overly permissive permissions echo "[*] Checking containerd directory permissions..." echo "[*] Target: CVE-2024-25621 - containerd Default Permission Vulnerability" echo "" # Affected paths PATHS=("/var/lib/containerd" "/run/containerd/io.containerd.grpc.v1.cri" "/run/containerd/io.containerd.sandbox.controller.v1.shim") VULNERABLE=false for path in "${PATHS[@]}"; do if [ -d "$path" ]; then echo "[+] Found directory: $path" perms=$(stat -c '%a' "$path" 2>/dev/null) echo " Permissions: $perms" # Check if group or others have write permission group_write=$(echo "$perms" | cut -c2) other_write=$(echo "$perms" | cut -c3) if [ "$group_write" -ge 2 ] || [ "$other_write" -ge 2 ]; then echo " [!] VULNERABLE: Group or others have write access" VULNERABLE=true elif [ "$group_write" -ge 4 ] || [ "$other_write" -ge 4 ]; then echo " [!] WARNING: Group or others have read access" fi # Check ownership and list contents owner=$(stat -c '%U:%G' "$path" 2>/dev/null) echo " Owner: $owner" echo " Contents:" ls -la "$path" 2>/dev/null | head -10 echo "" else echo "[-] Directory not found: $path" fi done if [ "$VULNERABLE" = true ]; then echo "[CRITICAL] System is VULNERABLE to CVE-2024-25621" echo "[*] Recommendation: Upgrade containerd to version 1.7.29, 2.0.7, 2.1.5, or 2.2.0+" echo "[*] Workaround: chmod 700 or 750 on affected directories" else echo "[+] System appears to be NOT vulnerable" fi echo "" echo "[*] Checking containerd version..." containerd --version 2>/dev/null || echo "containerd not found in PATH"