REDHAT-BUG-2500823: High severity cri-o cri-o vulnerability
A flaw was discovered in CRI-O's checkpoint and restore capability. If a container is restored from a checkpoint archive, CRI-O does not adequately validate the restore metadata. A sufficiently privileged user could therefore cause unintended host filesystem activity during the restore process. This behavior is only reachable when checkpoint and restore has been explicitly enabled; it is not active in the default CRI-O/OpenShift configuration. Exploitation also depends on the attacker being able to initiate a restore operation using checkpoint data that they control or supply.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Only CRI-O environments where checkpoint and restore has been explicitly enabled are exposed. The capability is not active in the default CRI-O or OpenShift configuration.
What access does an attacker need to exploit it?
An attacker needs sufficient privileges to initiate a restore operation and must be able to use checkpoint data they control or supply.
What should be prioritized if checkpoint and restore cannot be disabled immediately?
Restrict who can initiate restore operations and prevent untrusted users from supplying checkpoint archives. The described behavior depends on both restore access and attacker-controlled checkpoint data.