Security readout for executives and security teams
Plain-English summary
CVE-2024-8676 lets CRI-O restore a container checkpoint using mounts from the archive, bypassing pod mount validation. If an attacker can reach the kubelet or CRI-O socket, they may restore a pod with unauthorized host mounts, risking host data exposure or modification.
Executive priority
Prioritize remediation for OpenShift or Kubernetes environments with shared administration, multi-tenant workloads, or broad node socket access. This is not reported as actively exploited, but unauthorized host mount access can materially affect confidentiality and integrity.
Technical view
The flaw is an authorization bypass in CRI-O checkpoint restore. During restore, CRI-O validates the requested pod spec but restores mount definitions from the checkpoint archive. That mismatch can permit host mounts not authorized for the pod. Red Hat rates it high, CVSS 7.4, CWE-285.
Likely exposure
Highest concern is Kubernetes/OpenShift nodes where untrusted users, workloads, or automation can access the kubelet or CRI-O socket. Red Hat lists affected OpenShift 4.15, 4.16, 4.17, 4.18 components and some RHEL container packages. Product status varies by package and advisory.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. Exploitation requires access to the kubelet or CRI-O socket and ability to trigger the restore endpoint, making socket exposure and node-level access controls central to risk.
Researcher notes
Key issue is validation confusion between pod spec mounts and checkpoint archive mounts during restore. Do not assume network-only exposure; practical exploitability depends on access to kubelet or CRI-O socket. Red Hat package impact is nuanced, so validate by advisory and installed package.
Mitigation direction
- Apply applicable Red Hat errata for affected OpenShift, RHCOS, and RHEL container packages.
- Review Red Hat CVE guidance for exact package status and fixed builds.
- Restrict kubelet and CRI-O socket access to trusted node components only.
- Disable or tightly control checkpoint/restore workflows where not operationally required.
Validation and detection
- Inventory OpenShift, RHCOS, CRI-O, podman, and conmon versions against Red Hat advisories.
- Confirm affected nodes have received the relevant Red Hat security or bugfix errata.
- Verify untrusted users and workloads cannot access kubelet or CRI-O sockets.
- Review cluster policies governing checkpoint and restore capability usage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-8676 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2redhatVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHBA-2024:10826CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:0648CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:1908CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3297CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4211CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9765CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-8676CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2313842CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.