CVE-2024-8676: CRI-O Arbitrary Node Access via Malicious Checkpoint File
Summary
CVE-2024-8676: CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o. Affects github.com/cri-o/cri-o across 3 version ranges.
< 1.29.11
>= 1.30.0, < 1.30.8
>= 1.31.0, < 1.31.3
Fixed in 1.29.11, 1.30.8 or 1.31.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CRI-O is an open-source container runtime specifically designed for Kubernetes. It allows for the management of container images and the execution of containers in a Kubernetes environment. CRI-O is lightweight and integrates seamlessly with Kubernetes, providing essential functionalities such as image management, container lifecycle management, and resource management. However, it is susceptible to vulnerabilities that can compromise the security of the nodes it operates on, particularly through improperly structured checkpoint files.
Vulnerability Detail
The vulnerability identified as CVE-2024-8676 arises from the ability of a maliciously structured checkpoint file to gain arbitrary access to nodes running CRI-O. This issue can be exploited by an attacker who crafts a specific checkpoint file that, when processed by CRI-O, can lead to unauthorized access to sensitive resources or control over the node. The implications of this vulnerability are significant, as it could allow an attacker to manipulate container operations, access confidential data, or disrupt services running on the affected node.
How To Fix
Latest published version: v1.37.2 as of 23 Oct 2026
go get github.com/cri-o/cri-o@v1.37.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.29.111.29.11go get github.com/cri-o/cri-o@v1.29.11 -
>= 1.30.0, < 1.30.81.30.8go get github.com/cri-o/cri-o@v1.30.8 -
>= 1.31.0, < 1.31.31.31.3go get github.com/cri-o/cri-o@v1.31.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted checkpoint files. Implement strict validation and sanitization of checkpoint files before they are processed by CRI-O to reduce the risk of exploitation until an update can be applied.
Conclusion
In summary, CVE-2024-8676 is a critical vulnerability in CRI-O that allows unauthorized access through malicious checkpoint files. It is crucial for users to update to the latest patched versions to secure their systems. Additionally, employing workarounds and monitoring tools like Vulert can help mitigate risks associated with this vulnerability.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
CVE-2024-8676 is a vulnerability in CRI-O that allows a maliciously structured checkpoint file to gain arbitrary access to nodes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability could lead to unauthorized access to sensitive resources, manipulation of container operations, or disruption of services on the affected node.
You can update CRI-O by running the command go get github.com/cri-o/cri-o@v1.31.3 or by using your system's package manager to install the latest version.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just the Gopkg.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
