Description

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-21T09:17:05.743Z",
  "pubdate": "2026-09-21T09:17:05.743Z",
  "executiveSummary": "A critical security vulnerability exists within the container checkpoint and restore feature of CRI-O. The flaw arises from insufficient validation of metadata provided within checkpoint archives during the restoration process. This security deficit allows an authenticated user with sufficient privileges to manipulate the restore operation, potentially leading to unauthorized actions on the host filesystem.\nThe vulnerability is limited to environments where the checkpoint and restore functionality is explicitly enabled, as it remains disabled by default. Successful exploitation necessitates that an attacker possesses the capability to trigger the restoration of a container using a malicious or untrusted checkpoint archive. Given these prerequisites, the risk is primarily associated with multi-tenant environments or systems where untrusted users can influence container lifecycle operations. The impact is significant, as it grants the ability to bypass container isolation and interact with the host system, potentially leading to privilege escalation or unauthorized data access on the underlying infrastructure.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure deserialization or processing of checkpoint metadata files during the CRI-O container restoration workflow. When CRI-O attempts to restore a container from an archive, it relies on metadata embedded within that archive to reconstruct the container's state, including filesystem mounts, namespaces, and security contexts. The current implementation fails to perform rigorous validation of the parameters contained within this metadata.\nExploitation is achieved by constructing a malicious checkpoint archive that contains crafted configuration data. By injecting anomalous values into the restore metadata—specifically those governing filesystem paths or symbolic links—an attacker can manipulate the container runtime's interaction with the host filesystem. During the restore process, the CRI-O runtime processes these paths without adequate sanitization or boundary enforcement. If the runtime operates with elevated privileges, the malicious metadata can induce the system to perform operations outside the intended container root, such as file read/write operations on arbitrary host paths.\nThe attack flow proceeds as follows: First, the attacker gains access to an environment where checkpoint/restore is enabled. Second, the attacker generates a manipulated checkpoint archive, modifying the internal configuration files to point to protected host directories or configuration files. Third, the attacker triggers the CRI-O API to restore the container using this malicious archive. Finally, the runtime, blinded by the lack of validation, executes the restoration steps using the attacker-supplied paths, effectively providing the attacker an interface to traverse or influence the host filesystem.\nThis vulnerability is localized to the checkpoint/restore logic within CRI-O. Because it operates at the runtime level, it does not require network exposure; it is an internal privilege escalation vector. Authentication is required to interact with the CRI-O daemon, typically necessitating local user access or Kubernetes administrative privileges. The post-exploitation impact includes the potential for host-to-container breakout, persistence via file modification on the host, or exposure of sensitive host-level credentials and configuration files stored in areas accessible to the CRI-O runtime."
}