Every CVE Search/ Get API key

CVE-2024-8676

Cri-o: checkpoint restore can be triggered from different namespaces

7.4 HighFix available

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.75%Up 0.7 points since Nov 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.4

Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Record
CVE-2024-8676
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-05
EUVDEUVD-2024-3348 7.4

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Record
EUVD-2024-3348
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-7p9f-6x8j-gxxp 6.9

CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

Impact

Patches

1.31.1, 1.30.6, 1.29.8

Workarounds

set enable_criu_support = false

References

Are there any links users can visit to find out more?

Record
GHSA-7p9f-6x8j-gxxp
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-02
NVD 7.4

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Record
CVE-2024-8676
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-05
OSV 7.4

Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Record
CVE-2024-8676
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-07
OSVGHSA-7p9f-6x8j-gxxp 6.9

CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

Impact

Patches

1.31.1, 1.30.6, 1.29.8

Workarounds

set enable_criu_support = false

References

Are there any links users can visit to find out more?

Record
GHSA-7p9f-6x8j-gxxp
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-02
Show 6 moreShow less
OSVRHBA-2024:10826 7.4

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.16.26 packages and security update

Record
RHBA-2024:10826
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:0648 7.4

Red Hat Security Advisory: OpenShift Container Platform 4.15.44 security update

Record
RHSA-2025:0648
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:1908 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.18.2 packages and security update

Record
RHSA-2025:1908
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-53540 No score

CVE-2024-8676 affecting package cri-o 1.30.1-1

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

Record
AZL-53540
Updated
2026-11-05
OSVGO-2024-3292 No score

CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o

CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o

Record
GO-2024-3292
Updated
2026-11-02
OSVopenSUSE-SU-2024:14567-1 No score

govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14567-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/cri-o/cri-o
Go
 before 1.29.11
1.29.11
github.com/cri-o/cri-o
Go
 1.30.0 up to 1.30.8
1.30.8
github.com/cri-o/cri-o
Go
 1.31.0 up to 1.31.3
1.31.3
cri-o
Azure Linux:3
 through 1.30.1-1 None known
github.com/cri-o/cri-o
Go
 before 1.29.11, 1.30.0 up to 1.30.8, 1.31.0 up to 1.31.3
1.29.111.30.81.31.3
cri-o
Red Hat:openshift:4.16::el8
 before 0:1.29.11-3.rhaos4.16.git16d9bd6.el8
0:1.29.11-3.rhaos4.16.git16d9bd6.el8
cri-o-debuginfo
Red Hat:openshift:4.16::el8
 before 0:1.29.11-3.rhaos4.16.git16d9bd6.el8
0:1.29.11-3.rhaos4.16.git16d9bd6.el8
cri-o-debugsource
Red Hat:openshift:4.16::el8
 before 0:1.29.11-3.rhaos4.16.git16d9bd6.el8
0:1.29.11-3.rhaos4.16.git16d9bd6.el8
cri-o
Red Hat:openshift:4.16::el9
 before 0:1.29.11-3.rhaos4.16.git16d9bd6.el9
0:1.29.11-3.rhaos4.16.git16d9bd6.el9
cri-o-debuginfo
Red Hat:openshift:4.16::el9
 before 0:1.29.11-3.rhaos4.16.git16d9bd6.el9
0:1.29.11-3.rhaos4.16.git16d9bd6.el9
Show 19 moreShow less
Affected packages
PackageAffectedFixed
cri-o-debugsource
Red Hat:openshift:4.16::el9
 before 0:1.29.11-3.rhaos4.16.git16d9bd6.el9
0:1.29.11-3.rhaos4.16.git16d9bd6.el9
cri-o
Red Hat:openshift:4.15::el8
 before 0:1.28.11-7.rhaos4.15.gitc4c0556.el8
0:1.28.11-7.rhaos4.15.gitc4c0556.el8
cri-o-debuginfo
Red Hat:openshift:4.15::el8
 before 0:1.28.11-7.rhaos4.15.gitc4c0556.el8
0:1.28.11-7.rhaos4.15.gitc4c0556.el8
cri-o-debugsource
Red Hat:openshift:4.15::el8
 before 0:1.28.11-7.rhaos4.15.gitc4c0556.el8
0:1.28.11-7.rhaos4.15.gitc4c0556.el8
cri-o
Red Hat:openshift:4.15::el9
 before 0:1.28.11-7.rhaos4.15.gitc4c0556.el9
0:1.28.11-7.rhaos4.15.gitc4c0556.el9
cri-o-debuginfo
Red Hat:openshift:4.15::el9
 before 0:1.28.11-7.rhaos4.15.gitc4c0556.el9
0:1.28.11-7.rhaos4.15.gitc4c0556.el9
cri-o-debugsource
Red Hat:openshift:4.15::el9
 before 0:1.28.11-7.rhaos4.15.gitc4c0556.el9
0:1.28.11-7.rhaos4.15.gitc4c0556.el9
cri-o
Red Hat:openshift:4.18::el8
From an advisory covering 2 CVEs
 before 0:1.31.5-5.rhaos4.18.git6dfa0a6.el8
0:1.31.5-5.rhaos4.18.git6dfa0a6.el8
cri-o-debuginfo
Red Hat:openshift:4.18::el8
From an advisory covering 2 CVEs
 before 0:1.31.5-5.rhaos4.18.git6dfa0a6.el8
0:1.31.5-5.rhaos4.18.git6dfa0a6.el8
cri-o-debugsource
Red Hat:openshift:4.18::el8
From an advisory covering 2 CVEs
 before 0:1.31.5-5.rhaos4.18.git6dfa0a6.el8
0:1.31.5-5.rhaos4.18.git6dfa0a6.el8
cri-o
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 0:1.31.5-5.rhaos4.18.git6dfa0a6.el9
0:1.31.5-5.rhaos4.18.git6dfa0a6.el9
cri-o-debuginfo
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 0:1.31.5-5.rhaos4.18.git6dfa0a6.el9
0:1.31.5-5.rhaos4.18.git6dfa0a6.el9
cri-o-debugsource
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 0:1.31.5-5.rhaos4.18.git6dfa0a6.el9
0:1.31.5-5.rhaos4.18.git6dfa0a6.el9
buildah
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 2:1.33.12-1.rhaos4.18.el9
2:1.33.12-1.rhaos4.18.el9
buildah-debuginfo
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 2:1.33.12-1.rhaos4.18.el9
2:1.33.12-1.rhaos4.18.el9
buildah-debugsource
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 2:1.33.12-1.rhaos4.18.el9
2:1.33.12-1.rhaos4.18.el9
buildah-tests
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 2:1.33.12-1.rhaos4.18.el9
2:1.33.12-1.rhaos4.18.el9
buildah-tests-debuginfo
Red Hat:openshift:4.18::el9
From an advisory covering 2 CVEs
 before 2:1.33.12-1.rhaos4.18.el9
2:1.33.12-1.rhaos4.18.el9
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 0.0.20241209T183251-1.1
0.0.20241209T183251-1.1

History

History
RecordedChangedSources
affectedNVD, OSV
factsCVE List, EUVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-8676 is a high vulnerability (CVSS 7.4) in Red Hat Enterprise Linux 8, published November 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in github.com/cri-o/cri-o 1.29.11.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open