Description
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cri-o | < 1.29.11, 1.30.0 – < 1.30.8, 1.31.0 – < 1.31.3 | 1.29.11 |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | buildah +1 | 2:1.33.12-1.rhaos4.18.el9 | RHSA-2025:1908 |
| Red Hat OpenShift 4 | cri-o | 1.28.11-7.rhaos4.15.gitc4c0556.el8 | RHSA-2025:1908, RHSA-2025:0648, RHBA-2024:10826 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241209T183251-1.1 | openSUSE-SU-2024:14567-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | < 1.29.11 | 1.29.11 | GHSA-7p9f-6x8j-gxxp |
| Go | github.com/cri-o/cri-o | >= 1.30.0, < 1.30.8 | 1.30.8 | GHSA-7p9f-6x8j-gxxp |
| Go | github.com/cri-o/cri-o | >= 1.31.0, < 1.31.3 | 1.31.3 | GHSA-7p9f-6x8j-gxxp |
| Go | github.com/cri-o/cri-o | < 1.29.11 · >= 1.30.0, < 1.30.8 · >= 1.31.0, < 1.31.3 | 1.29.11, 1.30.8, 1.31.3 | GO-2024-3292 |
Advisories 5
- RHSA-2025:1908 Red Hat Security Advisory: OpenShift Container Platform 4.18.2 packages and security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:0648 Red Hat Security Advisory: OpenShift Container Platform 4.15.44 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHBA-2024:10826 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.16.26 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2024:14567-1 govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0216 Red Hat OpenShift Container Platform: Schwachstelle ermöglicht Umgehung von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 1, 2025
References
- RHBA-2024:10826 vendor-advisory
- RHSA-2025:0648 vendor-advisory
- RHSA-2025:1908 vendor-advisory
- RHSA-2025:3297 vendor-advisory
- RHSA-2025:4211 vendor-advisory
- RHSA-2025:9765 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8676 vdb-entry
- RHBZ#2313842 issue-tracking