Permissions, Privileges, and Access Controls in CRI-O - CVE-2024-8676
Published: February 2, 2025
Vulnerability identifier: #VU103485
CSH Severity: Low
CVSS v4: 6.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]
CVE-ID: CVE-2024-8676
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to the way CRI-O handles restoration of archive container. A remote user with access to the kubelet or cri-o socket can call the restore endpoint and trigger the restore.When restoration starts, the application will attempt to restore the mounts from the restore archive instead of the pod request and access host mounts.
Affected software
CRI-O
cri-o (Red Hat package)
Red Hat OpenShift Container Platform
cri-o (Red Hat package)
Red Hat OpenShift Container Platform
How to mitigate CVE-2024-8676
Install updates from vendor's website.
CRI-O - addressed in versions 1.29.11, 1.30.8, 1.31.3
cri-o (Red Hat package) - addressed in versions 1.28.11-7.rhaos4.15.gitc4c0556.el8, 1.28.11-7.rhaos4.15.gitc4c0556.el9
Red Hat OpenShift Container Platform - addressed in versions 4.15.44, 4.17.20, 4.17.23, 4.18.4, 4.18.11
cri-o (Red Hat package) - addressed in versions 1.28.11-7.rhaos4.15.gitc4c0556.el8, 1.28.11-7.rhaos4.15.gitc4c0556.el9
Red Hat OpenShift Container Platform - addressed in versions 4.15.44, 4.17.20, 4.17.23, 4.18.4, 4.18.11
External References
Related Security Bulletins
- Privilege escalation in CRI-O
- Permissions, Privileges, and Access Controls in Red Hat OpenShift Container Platform 4.15
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
- Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18