📄 Ubuntu 25.10 Containerd Insecure Directory Permissions

=============================================================================================================================================
    | # Title     : Ubuntu 25.10 Containerd Insecure Directory Permissions Vulnerability                                                        |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://ubuntu.com/                                                                                                         |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/214598/ & CVE-2024-25621, CVE-2025-64329
    
    [+] Summary    : This Proof of Concept (PoC) demonstrates and detects CVE-2024-25621, a security vulnerability in containerd caused by insecure permissions on critical runtime and data directories. 
                     Affected versions may expose container metadata and runtime artifacts due to directories being readable or writable by non-privileged users.
                     The scanner checks the installed containerd version against known vulnerable ranges and audits permissions on sensitive directories such as /var/lib/containerd and /run/containerd/*. 
    				 When verbose mode is enabled, it safely tests read/write access without performing destructive actions, with optional dry-run support.
                     If vulnerable conditions are detected, the tool highlights potential impacts including unauthorized access, information disclosure, and possible privilege escalation, 
    				 and provides clear remediation guidance such as upgrading containerd and correcting directory permissions.
    
    [+] Usage : 
    
    chmod +x poc_cve_2024_25621.py
    
    ./poc_cve_2024_25621.py --verbose
    
    ./poc_cve_2024_25621.py --dry-run
    
    
    [+] POC : 
    
    #!/usr/bin/env python3
    
    import os
    import stat
    import sys
    import subprocess
    import argparse
    import re
    from datetime import datetime
    
    class ContainerdPoC:
        def __init__(self, verbose=False, dry_run=False):
            self.verbose = verbose
            self.dry_run = dry_run
            self.vulnerable_dirs = [
                "/var/lib/containerd",
                "/run/containerd/io.containerd.grpc.v1.cri",
                "/run/containerd/io.containerd.sandbox.controller.v1.shim"
            ]
            self.vulnerable_versions = {
                "1.7.0": "1.7.28",
                "2.0.0": "2.0.6",
                "2.1.0": "2.1.4",
                "2.2.0": "2.2.0"
            }
            self.test_files = []
    
        def log(self, message, level="INFO"):
            ts = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
            print(f"[{ts}] [{level}] {message}")
    
        def check_permissions(self, path):
            try:
                if not os.path.exists(path):
                    return None, "Directory does not exist"
    
                st = os.stat(path)
                perms = stat.S_IMODE(st.st_mode)
                perm_str = oct(perms)[-3:]
    
                group_write = bool(perms & stat.S_IWGRP)
                other_write = bool(perms & stat.S_IWOTH)
                group_read = bool(perms & stat.S_IRGRP)
                other_read = bool(perms & stat.S_IROTH)
    
                vulnerable = group_write or other_write
    
                return {
                    "path": path,
                    "permissions": perm_str,
                    "group_write": group_write,
                    "other_write": other_write,
                    "group_read": group_read,
                    "other_read": other_read,
                    "vulnerable": vulnerable,
                    "uid": st.st_uid,
                    "gid": st.st_gid
                }
            except Exception as e:
                return None, str(e)
    
        def check_containerd_version(self):
            try:
                r = subprocess.run(
                    ["containerd", "--version"],
                    capture_output=True,
                    text=True,
                    timeout=5
                )
                if r.returncode == 0:
                    m = re.search(r'v(\d+\.\d+\.\d+)', r.stdout)
                    if m:
                        return m.group(1), r.stdout.strip()
                return None, "Cannot determine version"
            except FileNotFoundError:
                return None, "containerd not found"
            except Exception as e:
                return None, str(e)
    
        def test_directory_access(self, directory):
            tests = []
    
            try:
                os.listdir(directory)
                tests.append(("LIST", "SUCCESS", "Directory readable"))
            except PermissionError:
                tests.append(("LIST", "FAILED", "Permission denied"))
            except Exception as e:
                tests.append(("LIST", "ERROR", str(e)))
    
            if self.dry_run:
                tests.append(("WRITE", "SKIPPED", "Dry-run enabled"))
                return tests
    
            test_file = os.path.join(
                directory, f".test_cve_2024_25621_{os.getpid()}"
            )
    
            try:
                with open(test_file, "w") as f:
                    f.write("PoC Test\n")
    
                self.test_files.append(test_file)
                tests.append(("WRITE", "SUCCESS", "File created"))
    
                with open(test_file, "r") as f:
                    f.read()
                tests.append(("READ", "SUCCESS", "File read"))
    
            except PermissionError:
                tests.append(("WRITE", "FAILED", "Permission denied"))
            except Exception as e:
                tests.append(("WRITE", "ERROR", str(e)))
    
            return tests
    
        def compare_versions(self, v1, v2):
            def normalize(v):
                v = re.sub(r'[-_].*$', '', v)
                return [int(x) for x in v.split('.')]
    
            a = normalize(v1)
            b = normalize(v2)
            return (a > b) - (a < b)
    
        def cleanup(self):
            for f in self.test_files:
                try:
                    if os.path.exists(f):
                        os.remove(f)
                except:
                    pass
    
        def run_scan(self):
            print("=" * 60)
            print("Containerd CVE-2024-25621 Vulnerability Scanner By indoushka")
            print("=" * 60)
    
            print("\n[1] Checking containerd version...")
            version, info = self.check_containerd_version()
            if version:
                print(f"  Version: {version}")
                vulnerable = False
                for min_v, max_v in self.vulnerable_versions.items():
                    if self.compare_versions(min_v, version) <= 0 and \
                       self.compare_versions(version, max_v) <= 0:
                        vulnerable = True
                        print(f"    VULNERABLE ({min_v} → {max_v})")
                        break
                if not vulnerable:
                    print(" Version appears patched")
            else:
                print(f"  {info}")
    
            print("\n[2] Checking directory permissions...")
            found = []
            for d in self.vulnerable_dirs:
                r, e = self.check_permissions(d)
                if r:
                    print(f"\n  {d}")
                    print(f"  Perms: {r['permissions']} | Vulnerable: {r['vulnerable']}")
                    if r["vulnerable"]:
                        found.append(d)
                    if self.verbose:
                        for t in self.test_directory_access(d):
                            print(f"    {t[0]}: {t[1]} - {t[2]}")
                else:
                    print(f"\n  {d} - {e}")
    
            print("\n" + "=" * 60)
            if found:
                print(" SYSTEM IS VULNERABLE")
                for d in found:
                    print(f"  - {d}")
            else:
                print(" SYSTEM APPEARS SECURE")
            print("=" * 60)
    
    
    def main():
        p = argparse.ArgumentParser()
        p.add_argument("-v", "--verbose", action="store_true")
        p.add_argument("-d", "--dry-run", action="store_true")
        args = p.parse_args()
    
        poc = ContainerdPoC(args.verbose, args.dry_run)
        try:
            poc.run_scan()
        finally:
            poc.cleanup()
    
    
    if __name__ == "__main__":
        main()
    
    		
    Greetings to :============================================================
    jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
    ==========================================================================