CRI-O: restoring a malicious checkpoint keeps the source security context and bypasses pod policy

Impact

A tenant who can create a pod from a checkpoint image they control gets a process that keeps the credentials, Linux capabilities, no_new_privs flag and seccomp state baked into the checkpoint instead of the ones the destination pod spec asks for. On a shared GPU cluster that is a direct escape from the security context an operator thought it was enforcing: the restored container can run with capabilities and a seccomp profile that admission policy would never have admitted, on a node that also hosts other tenants' GPU workloads. Red Hat scores it 8.8 with confidentiality, integrity and availability all high. CRI-O 1.34 and later are affected upstream; downstream OpenShift from 4.17 onward.

Who can reach it

An authenticated cluster user with permission to create a pod, on a cluster where CRI-O checkpoint/restore is enabled, who can supply a checkpoint image of their choosing. No node access and no host foothold needed.

What to do

No fixed release exists yet - Red Hat states the fixes are merged to supported branches but not shipped. Until a build lands, the practical mitigation is to turn off checkpoint/restore support in CRI-O (it is not enabled by default in every distribution) and to restrict who may create pods from checkpoint images, for example by admission policy on the image source. Both are configuration changes; disabling the feature means editing the CRI-O config and restarting the runtime on each node, which evicts the pods on that node.

References

Related entries

• KubeVirt: Path traversal lets a user who can configure KubeVirt read arbitrary host filesCVE-2022-1798 · KubeVirtHigh
• BuildKit: Race between parallel build steps sharing cache mounts with subpathsCVE-2024-23651 · BuildKitHigh
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• Docker MCP Gateway: OCI image label controls run arguments, allowing host mounts and UID 0CVE-2026-55887 · Docker MCP Gateway (io.docker.server.metadata OCI label -> docker run arguments)High
• Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh