CVE-2024-8676
Cri-o: checkpoint restore can be triggered from different namespaces
HIGH 7.4
At a glance
- Source
- NVD
- EPSS
- EPSS 0.75 % · percentile 55 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.
Weaknesses (CWE)
- CWE-285 — Improper Authorization
References
- https://access.redhat.com/errata/RHBA-2024:10826
- https://access.redhat.com/errata/RHSA-2025:0648
- https://access.redhat.com/errata/RHSA-2025:1908
- https://access.redhat.com/errata/RHSA-2025:3297
- https://access.redhat.com/errata/RHSA-2025:4211
- https://access.redhat.com/errata/RHSA-2025:9765
- https://access.redhat.com/security/cve/CVE-2024-8676
- https://bugzilla.redhat.com/show_bug.cgi?id=2313842
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | redhat |
| CVSS 3.1 | HIGH 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-7p9f-6x8j-gxxp — CRI-O: Maliciously structured checkpoint file can gain arbitrary node access
- GO-2024-3292 — CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o
European references
- ENISA EUVD · EUVD-2024-3348
- GCVE · GCVE-0-2024-8676
Affected products
| Product | Versions |
|---|---|
| cri-o | affected 0 < 1.29.11 ; affected 1.30.0 < 1.30.8 ; affected 1.31.0 < 1.31.3 |
| Red Hat · Red Hat OpenShift Container Platform 4.15 | unaffected 0:1.28.11-7.rhaos4.15.gitc4c0556.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.16 | unaffected 0:1.29.11-3.rhaos4.16.git16d9bd6.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.16 | unaffected 416.94.202506251808-0 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.17 | unaffected 417.94.202503241418-0 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected 0:1.31.5-5.rhaos4.18.git6dfa0a6.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.18 | unaffected 418.94.202504231329-0 < * |
| Red Hat · Red Hat Enterprise Linux 8 | |
| Red Hat · Red Hat Enterprise Linux 8 | |
| Red Hat · Red Hat Enterprise Linux 9 | |
| Red Hat · Red Hat OpenShift Container Platform 3.11 | |
| Red Hat · Red Hat OpenShift Container Platform 4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |