containerd CRI Checkpoint Restore Privilege Escalation via CreateContainer API (CVE-2024-95837)

Vulnerability Overview Title: containerd CRI Plugin: Checkpoint Restore Bypasses Target Security Context Description: The CRI implementation in containerd allows containers to be restored from untrusted checkpoints via the API, thereby bypassing the target security context and executing with elevated privileges. When restoring a container from a checkpoint archive or an annotated OCI image, the CRI restores process credentials, Linux capabilities, , and seccomp state directly from the checkpoint data, rather than enforcing the target . An attacker can use a container with a crafted checkpoint image to execute processes with full capabilities and without seccomp filters as the root user, even though the orchestrator requested restrictive security policies. Furthermore, the containerd CRI status report reflects the requested configuration rather than the actual state of the restored processes, masking privilege discrepancies. This issue affects containerd on Linux systems with CRI checkpoint restore enabled; users who do not use CRI checkpoint restore are not affected. Scope Affected Versions: - github.com/containerd/containerd/v2 - >= 2.1.0 = 2.3.0 = 2.2.7, >= 2.3.4 CVE ID: CVE-2024-95837 Weakness: CWE-269 Remediation Patch: - This bug has been addressed in containerd 2.2.7 and 2.3.4 by disabling checkpoint restore via by default. This feature was completely removed in containerd 2.4.0. Users should update to these versions to resolve this issue. Containers restored from untrusted checkpoints should be stopped, deleted, and recreated. - Users relying on restoration via the API can re-enable this feature by setting the new configuration option. However, enabling restore via leaves this vulnerability present, as containerd cannot enforce target security policies during CRIU process restoration. Workaround: - In unpatched versions, containerd does not provide a configuration option to disable checkpoint restore via . Deployments should restrict container creation permissions to trusted users, verify container image registries, or use admission controllers to reject images containing checkpoint data. References CRIU image security Acknowledgments The containerd project thanks @2ydys and @berkpolatCE for responsibly disclosing this issue according to the containerd security policy. Additional Information If you have any questions or comments, please contact us via: Open an issue in containerd Send an email to security@containerd.io To report security issues in containerd: Report a new vulnerability Send an email to security@containerd.io

Goal Reached Thanks to every supporter — we hit 100%!

containerd CRI Checkpoint Restore Privilege Escalation via CreateContainer API (CVE-2024-95837)

More from this source