CyberRota Analysis
AI-GeneratedA vulnerability in the CRI-O checkpoint restore mechanism allows users to create pods from malicious checkpointed containers, potentially bypassing Kubernetes security contexts and retaining elevated privileges and sensitive credentials. This poses a significant risk of privilege escalation across container boundaries, impacting Linux and Kubernetes environments, particularly those using CRI-O versions 1.34 and later, as well as Red Hat OpenShift Container Platform 4.17 and beyond. Organizations utilizing these technologies should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.