GHSA-7p9f-6x8j-gxxp

CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

At a glance

Published: 2024-11-26 21:50 UTC
Updated: 2025-07-02 14:27 UTC
CVE: CVE-2024-8676
Aliases: GO-2024-3292
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Description

### Impact ### Patches 1.31.1, 1.30.6, 1.29.8 ### Workarounds set `enable_criu_support = false` ### References _Are there any links users can visit to find out more?_

Affected packages

Package	Versions
Go · github.com/cri-o/cri-o	introduced 0, fixed 1.29.11
Go · github.com/cri-o/cri-o	introduced 1.30.0, fixed 1.30.8
Go · github.com/cri-o/cri-o	introduced 1.31.0, fixed 1.31.3

References

https://github.com/cri-o/cri-o/security/advisories/GHSA-7p9f-6x8j-gxxp WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-8676 ADVISORY
https://github.com/cri-o/cri-o/commit/e8e7dcb7838d11b5157976bf3e31a5840bb77de7 WEB
https://access.redhat.com/errata/RHBA-2024:10826 WEB
https://access.redhat.com/errata/RHSA-2025:0648 WEB
https://access.redhat.com/errata/RHSA-2025:1908 WEB
https://access.redhat.com/errata/RHSA-2025:3297 WEB
https://access.redhat.com/errata/RHSA-2025:4211 WEB
https://access.redhat.com/errata/RHSA-2025:9765 WEB
https://access.redhat.com/security/cve/CVE-2024-8676 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2313842 WEB
https://github.com/cri-o/cri-o PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database