CVE-2025-47290 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-47290 Interim 1 7 2026-03-05T00:33:20Z current 2025-05-21T23:12:09Z 2026-03-05T00:33:20Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-47290 containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XU3W2GRJSEQXIANJXID5YIYCJA4B3VKT/ E-Mail link for openSUSE-SU-2025:15146-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NBVOKYMJCE2HZLSF5W3H3Q7KEHMMOQR3/ E-Mail link for openSUSE-SU-2025:15159-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SLES-LTSS-TERADATA 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 openSUSE Leap 15.6 openSUSE Tumbleweed containerd containerd-ctr containerd-devel containerd-test gnutls-3.8.3-slfo.1.1_5.1 govulncheck-vulndb-0.0.20250523T151856-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 kind-0.29.0-1.1 kind-bash-completion-0.29.0-1.1 kind-fish-completion-0.29.0-1.1 kind-zsh-completion-0.29.0-1.1 libgnutls30-3.8.3-slfo.1.1_5.1 gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-RT-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Base-qcow gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-SelfInstall libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-SelfInstall gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-encrypted libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-encrypted gnutls-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-qcow libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SL-Micro-Default-qcow libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-Azure libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-Azure libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-EC2 libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-BYOS-GCE libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-EC2 libgnutls30-3.8.3-slfo.1.1_5.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250523T151856-1.1 as a component of openSUSE Tumbleweed kind-0.29.0-1.1 as a component of openSUSE Tumbleweed kind-bash-completion-0.29.0-1.1 as a component of openSUSE Tumbleweed kind-fish-completion-0.29.0-1.1 as a component of openSUSE Tumbleweed kind-zsh-completion-0.29.0-1.1 as a component of openSUSE Tumbleweed containerd as a component of SLES-LTSS-TERADATA 15 SP2 containerd as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS containerd-ctr as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS containerd as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS containerd-ctr as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS containerd-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS containerd as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS containerd-ctr as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS containerd-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS containerd as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS containerd-ctr as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS containerd-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS containerd as a component of SUSE Linux Enterprise Micro 5.1 containerd as a component of SUSE Linux Enterprise Micro 5.2 containerd as a component of SUSE Linux Enterprise Micro 5.3 containerd as a component of SUSE Linux Enterprise Micro 5.4 containerd as a component of SUSE Linux Enterprise Micro 5.5 containerd as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 containerd as a component of SUSE Linux Enterprise Module for Containers 15 SP6 containerd-ctr as a component of SUSE Linux Enterprise Module for Containers 15 SP6 containerd-devel as a component of SUSE Linux Enterprise Module for Containers 15 SP6 containerd-ctr as a component of SUSE Linux Enterprise Module for Containers 15 SP7 containerd-devel as a component of SUSE Linux Enterprise Module for Containers 15 SP7 containerd as a component of SUSE Linux Enterprise Module for Containers 15 SP7 containerd as a component of SUSE Linux Enterprise Server 12 SP5-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 12 SP5-LTSS containerd-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS containerd as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security containerd as a component of SUSE Linux Enterprise Server 15 SP1-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 15 SP1-LTSS containerd as a component of SUSE Linux Enterprise Server 15 SP2-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 15 SP2-LTSS containerd as a component of SUSE Linux Enterprise Server 15 SP3-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 15 SP3-LTSS containerd as a component of SUSE Linux Enterprise Server 15 SP4-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 15 SP4-LTSS containerd-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS containerd as a component of SUSE Linux Enterprise Server 15 SP5-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 15 SP5-LTSS containerd-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS containerd as a component of SUSE Linux Enterprise Server 15-LTSS containerd-ctr as a component of SUSE Linux Enterprise Server 15-LTSS containerd as a component of SUSE Linux Enterprise Server Teradata 15 SP4 containerd as a component of SUSE Linux Micro 6.0 containerd as a component of SUSE Linux Micro 6.1 containerd as a component of openSUSE Leap 15.6 containerd-ctr as a component of openSUSE Leap 15.6 containerd-devel as a component of openSUSE Leap 15.6 containerd-test as a component of openSUSE Leap 15.6 containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. CVE-2025-47290 Image SL-Micro:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-RT-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-VMware:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Base-qcow:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-SelfInstall:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-SelfInstall:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-VMware:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-VMware:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-encrypted:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-encrypted:libgnutls30-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-qcow:gnutls-3.8.3-slfo.1.1_5.1 Image SL-Micro-Default-qcow:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-Azure:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-Azure:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-EC2:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-BYOS-GCE:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-EC2:libgnutls30-3.8.3-slfo.1.1_5.1 Image SLE-Micro-GCE:libgnutls30-3.8.3-slfo.1.1_5.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250523T151856-1.1 openSUSE Tumbleweed:kind-0.29.0-1.1 openSUSE Tumbleweed:kind-bash-completion-0.29.0-1.1 openSUSE Tumbleweed:kind-fish-completion-0.29.0-1.1 openSUSE Tumbleweed:kind-zsh-completion-0.29.0-1.1 SLES-LTSS-TERADATA 15 SP2:containerd SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:containerd SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:containerd-ctr SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:containerd SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:containerd-ctr SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:containerd-devel SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:containerd SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:containerd-ctr SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:containerd-devel SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:containerd SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:containerd-ctr SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:containerd-devel SUSE Linux Enterprise Micro 5.1:containerd SUSE Linux Enterprise Micro 5.2:containerd SUSE Linux Enterprise Micro 5.3:containerd SUSE Linux Enterprise Micro 5.4:containerd SUSE Linux Enterprise Micro 5.5:containerd SUSE Linux Enterprise Module for Basesystem 15 SP7:containerd SUSE Linux Enterprise Module for Containers 15 SP6:containerd SUSE Linux Enterprise Module for Containers 15 SP6:containerd-ctr SUSE Linux Enterprise Module for Containers 15 SP6:containerd-devel SUSE Linux Enterprise Module for Containers 15 SP7:containerd SUSE Linux Enterprise Module for Containers 15 SP7:containerd-ctr SUSE Linux Enterprise Module for Containers 15 SP7:containerd-devel SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:containerd SUSE Linux Enterprise Server 12 SP5-LTSS:containerd SUSE Linux Enterprise Server 12 SP5-LTSS:containerd-ctr SUSE Linux Enterprise Server 12 SP5-LTSS:containerd-devel SUSE Linux Enterprise Server 15 SP1-LTSS:containerd SUSE Linux Enterprise Server 15 SP1-LTSS:containerd-ctr SUSE Linux Enterprise Server 15 SP2-LTSS:containerd SUSE Linux Enterprise Server 15 SP2-LTSS:containerd-ctr SUSE Linux Enterprise Server 15 SP3-LTSS:containerd SUSE Linux Enterprise Server 15 SP3-LTSS:containerd-ctr SUSE Linux Enterprise Server 15 SP4-LTSS:containerd SUSE Linux Enterprise Server 15 SP4-LTSS:containerd-ctr SUSE Linux Enterprise Server 15 SP4-LTSS:containerd-devel SUSE Linux Enterprise Server 15 SP5-LTSS:containerd SUSE Linux Enterprise Server 15 SP5-LTSS:containerd-ctr SUSE Linux Enterprise Server 15 SP5-LTSS:containerd-devel SUSE Linux Enterprise Server 15-LTSS:containerd SUSE Linux Enterprise Server 15-LTSS:containerd-ctr SUSE Linux Enterprise Server Teradata 15 SP4:containerd SUSE Linux Micro 6.0:containerd SUSE Linux Micro 6.1:containerd openSUSE Leap 15.6:containerd openSUSE Leap 15.6:containerd-ctr openSUSE Leap 15.6:containerd-devel openSUSE Leap 15.6:containerd-test important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H