Key Information Vulnerability Description Name: CVE-2024-8676 Public Disclosure Date: November 27, 2024 Last Updated: November 26, 2024 Impact Level: Medium CVSS v3 Score: 7.4 Vulnerability Details Description: A vulnerability has been identified in CRI-O that allows a user to request the restoration of a container's checkpoint archive, and then be prompted to restore it. During restoration, it attempts to restore mounts from the restoration archive instead of from the restoration request. As a result, validation runs on the pod spec, checking whether the pod has access to the mounts it specifies, which does not apply to restored containers. This allows a malicious user to deceive CRI-O by restoring a pod that does not have access to host mounts. Mitigation: Currently, no mitigations are available, and no options meet Red Hat product security standards. Affected Packages and Red Hat Security Patches Affected Packages: - Red Hat Enterprise Linux 8: container-tools:rhel8/common - Red Hat Enterprise Linux 8: container-tools:rhel8/podman - Red Hat Enterprise Linux 9: common - Red Hat OpenShift Container Platform 3.11: cri-o - Red Hat OpenShift Container Platform 4: common - Red Hat OpenShift Container Platform 4: cri-o - Red Hat OpenShift Container Platform 4: rhcos Status: Not affected or affected CVSS v3 Score Details CVSS v3 Base Score: 7.4 Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: None Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? My product is listed as “under investigation” or “affected.” When will Red Hat release a fix for this vulnerability? If my product is listed as “not being fixed,” what should I do? If my product is listed as “fix delayed,” what should I do? What are mitigations? I have a Red Hat product, but it is not listed above. Is it affected? Why does my security scanner report this vulnerability on my product, even though my product version is fixed or unaffected? My product is listed as “out of support.” What does this mean? External References CVE-2024-8676 NVD Copyright CVE description copyright © 2021