Upstream information

CVE-2024-8676 at MITRE

Description

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (Red Hat)
Base Score 7.4
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact None
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1233812 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
Container bci/bci-busybox:16.0
Container rancher/elemental-channel/sl-micro:6.2-baremetal-8.2
Container rancher/elemental-channel/sl-micro:6.2-base-8.2
Container rancher/elemental-channel/sl-micro:6.2-kvm-8.2
Container rancher/elemental-channel/sl-micro:6.2-rt-8.2
Container suse/sl-micro/6.2/baremetal-iso-image:latest
Container suse/sl-micro/6.2/base-iso-image:latest
Container suse/sl-micro/6.2/kvm-iso-image:latest
Container suse/sl-micro/6.2/rt-iso-image:latest
  • busybox >= 1.37.0-160000.3.1
Container suse/sl-micro/6.0/baremetal-os-container:latest
Container suse/sl-micro/6.0/toolbox:latest
Image SL-Micro
Image SL-Micro-Base
Image SL-Micro-Base-RT
Image SL-Micro-Base-RT-SelfInstall
Image SL-Micro-Base-RT-encrypted
Image SL-Micro-Base-SelfInstall
Image SL-Micro-Base-encrypted
Image SL-Micro-Base-qcow
Image SL-Micro-Default
Image SL-Micro-Default-SelfInstall
Image SL-Micro-Default-encrypted
Image SL-Micro-Default-qcow
Image SLE-Micro
Image SLE-Micro-Azure
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-Azure
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-EC2
Image SLE-Micro-GCE
  • less >= 633-3.1
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE
  • mgrpxy >= 5.1.27-slfo.1.1.1
  • mgrpxy-bash-completion >= 5.1.27-slfo.1.1.1
  • suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image >= 5.1.3.1-8.19.2
  • suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image >= 5.1.3.1-9.17.3
  • suse-multi-linux-manager-5.1-x86_64-proxy-squid-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image >= 5.1.3.1-8.17.2
Image SUSE-Multi-Linux-Manager-Server-Azure-llc
Image SUSE-Multi-Linux-Manager-Server-Azure-ltd
Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure
Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2
Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE
Image SUSE-Multi-Linux-Manager-Server-EC2-llc
Image SUSE-Multi-Linux-Manager-Server-EC2-ltd
  • mgradm >= 5.1.27-slfo.1.1.1
  • mgradm-bash-completion >= 5.1.27-slfo.1.1.1
  • mgradm-lang >= 5.1.27-slfo.1.1.1
  • mgrctl >= 5.1.27-slfo.1.1.1
  • mgrctl-bash-completion >= 5.1.27-slfo.1.1.1
  • mgrctl-lang >= 5.1.27-slfo.1.1.1
  • suse-multi-linux-manager-5.1-x86_64-server-attestation-image >= 5.1.3.1-8.19.2
  • suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-server-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image >= 5.1.3.1-8.17.2
  • suse-multi-linux-manager-5.1-x86_64-server-postgresql-image >= 5.1.3.1-6.19.1
  • suse-multi-linux-manager-5.1-x86_64-server-saline-image >= 5.1.3.1-9.17.3
SUSE Linux Enterprise Server 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.0
  • govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
openSUSE Tumbleweed
  • govulncheck-vulndb >= 0.0.20241209T183251-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-14567

SUSE Timeline for this CVE

CVE page created: Tue Nov 26 20:00:29 2024
CVE page last modified: Wed Oct 28 17:25:11 2026