CVE-2024-8676
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.
- CVSS 3.1
- 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-25)
- CWE
- CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7p9f-6x8j-gxxp | Go | github.com/cri-o/cri-o | <1.29.11 | 1.29.11 |
| GHSA-7p9f-6x8j-gxxp | Go | github.com/cri-o/cri-o | >=1.30.0 <1.30.8 | 1.30.8 |
| GHSA-7p9f-6x8j-gxxp | Go | github.com/cri-o/cri-o | >=1.31.0 <1.31.3 | 1.31.3 |
| GO-2024-3292 | Go | github.com/cri-o/cri-o | <1.29.11 >=1.30.0 <1.30.8 >=1.31.0 <1.31.3 | 1.29.11, 1.30.8, 1.31.3 |