Description

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T10:17:17.360Z",
  "pubdate": "2026-09-21T10:17:17.360Z",
  "executiveSummary": "This vulnerability involves an improper security context enforcement within the CRI-O container runtime during the checkpoint restore process. A flaw in how container states are deserialized allows a user-supplied checkpoint image to override the security settings defined in the destination Kubernetes Pod specification. This results in the restored process inheriting sensitive attributes such as Linux capabilities, credentials, no_new_privs flags, and seccomp profiles from the malicious checkpointed container rather than adopting the restrictive settings mandated by the target environment. The vulnerability affects CRI-O version 1.34 and later, as well as Red Hat OpenShift Container Platform (OCP) 4.17 and subsequent versions. The impact is significant, as it enables privilege escalation across container boundaries, allowing an attacker to bypass critical security controls. Exploitation requires the attacker to possess sufficient permissions to create a pod using a malicious checkpoint image and relies on the availability of the checkpoint/restore functionality within the cluster. Because the runtime fails to sanitize the incoming checkpoint state against the destination pod's security context, the security isolation guarantees intended by Kubernetes are effectively neutralized.",
  "technicalDetails": "The vulnerability resides in the CRI-O checkpoint restoration logic, which fails to correctly reconcile the restored container state with the security context defined in the destination Pod specification. In a secure container lifecycle, the runtime is responsible for applying the security configuration—including User Namespaces, Linux Capabilities, and Seccomp filters—during the transition from an image or checkpoint to a running process. In this specific flaw, the restoration process prioritizes the state serialized within the checkpoint image over the security policy specified in the Kubernetes Pod manifest.\nThe root cause is an insufficient validation of the container security context during the checkpoint restore operation. When a container is checkpointed, its entire memory state, including kernel-level attributes and process security context markers (such as the effective capability set and the no_new_privs bit), is captured. Upon restoration, the CRI-O runtime improperly applies these captured attributes to the new process instance without re-validating them against the destination pod's securityContext parameters.\nExploitation follows a specific attack flow: First, an attacker creates a container with elevated privileges, such as CAP_SYS_ADMIN, and performs a checkpoint operation, saving the state to an external image or storage. Second, the attacker prepares a malicious Pod specification with restrictive security settings (e.g., non-root user, dropped capabilities). Third, the attacker initiates a checkpoint restore operation using the malicious checkpoint image. Because the CRI-O restoration component does not sanitize the checkpoint's internal security metadata, the new pod is instantiated with the elevated credentials and capabilities preserved from the initial, privileged container state.\nThis bypasses critical security barriers, including the enforcement of no_new_privs, which is meant to prevent the acquisition of new privileges via execve, and seccomp, which restricts system calls. By injecting a checkpoint that disables or limits these security mechanisms, an attacker can gain arbitrary code execution with elevated privileges that were specifically intended to be restricted in the destination container environment. This results in a total failure of the container isolation model, potentially allowing container escape or host-level compromise if the runtime configuration allows it. Affected versions include CRI-O 1.34 and later, and OCP 4.17 and later, requiring urgent patch application once available from official downstream vendors."
}