Summary
A flaw in CRIU's handling of restartable sequences (rseq) during checkpoint/restore allows a malicious container process to hijack parasite code injection and spoof its credentials in the checkpoint image.
When such a crafted image is later restored, the process can come back with elevated capabilities and zeroed UIDs/GIDs, though practical impact depends heavily on surrounding container runtime hardening.
A flaw in CRIU's handling of restartable sequences (rseq) during checkpoint/restore allows a malicious container process to hijack parasite code injection and spoof its credentials in the checkpoint image.
When such a crafted image is later restored, the process can come back with elevated capabilities and zeroed UIDs/GIDs, though practical impact depends heavily on surrounding container runtime hardening.
Affected context
This vulnerability appears in environments that use CRIU to perform container or process checkpoint/restore, typically via higher-level tools such as podman or Kubernetes/OpenShift integrations.
It manifests when CRIU handles restartable sequences and injects parasite code into a process during checkpointing, and that process is able to register a carefully crafted rseq critical section.
The risk is constrained in hardened deployments where checkpoint/restore is restricted to root or cluster-admin roles, user namespaces are enabled, SELinux and seccomp policies remain in force, and mount namespace ownership checks are enforced by the kernel.
This vulnerability appears in environments that use CRIU to perform container or process checkpoint/restore, typically via higher-level tools such as podman or Kubernetes/OpenShift integrations.
It manifests when CRIU handles restartable sequences and injects parasite code into a process during checkpointing, and that process is able to register a carefully crafted rseq critical section.
The risk is constrained in hardened deployments where checkpoint/restore is restricted to root or cluster-admin roles, user namespaces are enabled, SELinux and seccomp policies remain in force, and mount namespace ownership checks are enforced by the kernel.
Exploit preconditions
- Attack surface: Processes being checkpointed by CRIU, usually container workloads under podman, Kubernetes, or OpenShift.
- Required access: Ability for an attacker to run code inside a container or process that will be checkpointed by CRIU; ability for an administrator or orchestration system to trigger checkpoint/restore (the attacker typically cannot trigger it directly).
- Trigger point: During CRIU's checkpoint phase when parasite code is injected and interacts with restartable sequences registered by the target process.
- Why exploitation is possible: CRIU does not safely handle attacker-controlled rseq critical sections, allowing the malicious process to interfere with the parasite's execution and manipulate the credentials or capability state that CRIU records in the checkpoint image, which is then replayed on restore.
- Attack surface: Processes being checkpointed by CRIU, usually container workloads under podman, Kubernetes, or OpenShift.
- Required access: Ability for an attacker to run code inside a container or process that will be checkpointed by CRIU; ability for an administrator or orchestration system to trigger checkpoint/restore (the attacker typically cannot trigger it directly).
- Trigger point: During CRIU's checkpoint phase when parasite code is injected and interacts with restartable sequences registered by the target process.
- Why exploitation is possible: CRIU does not safely handle attacker-controlled rseq critical sections, allowing the malicious process to interfere with the parasite's execution and manipulate the credentials or capability state that CRIU records in the checkpoint image, which is then replayed on restore.
Why this happens
The underlying issue is an improper privilege and context management bug in how CRIU coordinates its privileged checkpoint logic with untrusted process state, specifically restartable sequences.
By trusting rseq state that is under full control of the process being checkpointed, CRIU allows that process to influence the behavior of its parasite code, which executes with higher privileges and is responsible for capturing security-critical information such as credentials and capabilities.
This maps to CWE-269: Improper Privilege Management, where a privileged component fails to properly separate its trust boundary from lower-privileged code and ends up persisting an incorrect, more-privileged security context into the checkpoint image.
The underlying issue is an improper privilege and context management bug in how CRIU coordinates its privileged checkpoint logic with untrusted process state, specifically restartable sequences.
By trusting rseq state that is under full control of the process being checkpointed, CRIU allows that process to influence the behavior of its parasite code, which executes with higher privileges and is responsible for capturing security-critical information such as credentials and capabilities.
This maps to CWE-269: Improper Privilege Management, where a privileged component fails to properly separate its trust boundary from lower-privileged code and ends up persisting an incorrect, more-privileged security context into the checkpoint image.
Potential impact
- A restored container process may come back with elevated Linux capabilities compared to its original runtime state.
- UIDs and GIDs of the restored process could be reset to zero, making it appear as root within its namespace.
- Within the container or user namespace, the process can perform privileged operations that were previously blocked by its original credentials.
- In less-hardened or misconfigured environments, the spoofed capabilities could contribute to a broader escalation path or unauthorized resource access.
- Security monitoring and forensics that rely on checkpointed identity data may be misled by falsified credentials stored in images.
- A restored container process may come back with elevated Linux capabilities compared to its original runtime state.
- UIDs and GIDs of the restored process could be reset to zero, making it appear as root within its namespace.
- Within the container or user namespace, the process can perform privileged operations that were previously blocked by its original credentials.
- In less-hardened or misconfigured environments, the spoofed capabilities could contribute to a broader escalation path or unauthorized resource access.
- Security monitoring and forensics that rely on checkpointed identity data may be misled by falsified credentials stored in images.
General mitigation guidance
Effective mitigation focuses on hardening the privilege boundary around checkpoint/restore and reducing the blast radius of any credential spoofing:
- Restrict the ability to invoke CRIU checkpoint/restore operations to trusted administrators, root-only tools, or tightly controlled orchestrator components.
- Run containers and workloads inside user namespaces by default so that even processes appearing as root are limited to namespace-scoped capabilities.
- Maintain strict SELinux type enforcement for containerized workloads, ensuring that privilege transitions remain blocked regardless of spoofed credentials.
- Preserve and enforce seccomp filter profiles across checkpoint/restore cycles so that system call exposure remains unchanged.
- Ensure kernel and container runtime configurations enforce robust mount namespace ownership checks, reducing the value of elevated capabilities for escape.
- Apply a defense-in-depth policy: consider any data derived from untrusted process state (such as rseq regions) untrusted, and isolate checkpoint logic from influence by the target process wherever feasible.
Effective mitigation focuses on hardening the privilege boundary around checkpoint/restore and reducing the blast radius of any credential spoofing:
- Restrict the ability to invoke CRIU checkpoint/restore operations to trusted administrators, root-only tools, or tightly controlled orchestrator components.
- Run containers and workloads inside user namespaces by default so that even processes appearing as root are limited to namespace-scoped capabilities.
- Maintain strict SELinux type enforcement for containerized workloads, ensuring that privilege transitions remain blocked regardless of spoofed credentials.
- Preserve and enforce seccomp filter profiles across checkpoint/restore cycles so that system call exposure remains unchanged.
- Ensure kernel and container runtime configurations enforce robust mount namespace ownership checks, reducing the value of elevated capabilities for escape.
- Apply a defense-in-depth policy: consider any data derived from untrusted process state (such as rseq regions) untrusted, and isolate checkpoint logic from influence by the target process wherever feasible.
How teams detect issues like this
Detection commonly relies on reviewing how checkpoint/restore is configured and used rather than spotting exploits directly:
- Use static and configuration analysis to identify components that invoke CRIU, verifying they run under minimal necessary privileges and cannot be triggered by untrusted tenants.
- During code review of CRIU integrations, look for patterns where privileged helper code (parasites, sidecars, or checkpoint helpers) uses or trusts unvalidated process state, particularly low-level kernel features such as rseq.
- Monitor orchestration logs (podman, kubelet, OpenShift) for unexpected checkpoint/restore activity, especially on workloads controlled by untrusted users.
- Employ policy enforcement (e.g., admission controllers, CI checks) to ensure workload pods with access to checkpoint APIs or hostUsers-like features are limited to administrative contexts.
- Consider using automated security scanners or SAST tools that highlight improper boundary handling between privileged helpers and untrusted processes.
Detection commonly relies on reviewing how checkpoint/restore is configured and used rather than spotting exploits directly:
- Use static and configuration analysis to identify components that invoke CRIU, verifying they run under minimal necessary privileges and cannot be triggered by untrusted tenants.
- During code review of CRIU integrations, look for patterns where privileged helper code (parasites, sidecars, or checkpoint helpers) uses or trusts unvalidated process state, particularly low-level kernel features such as rseq.
- Monitor orchestration logs (podman, kubelet, OpenShift) for unexpected checkpoint/restore activity, especially on workloads controlled by untrusted users.
- Employ policy enforcement (e.g., admission controllers, CI checks) to ensure workload pods with access to checkpoint APIs or hostUsers-like features are limited to administrative contexts.
- Consider using automated security scanners or SAST tools that highlight improper boundary handling between privileged helpers and untrusted processes.
Sources
| Source | Link |
|---|---|
| access. | access.redhat.com/ |
| bugzilla. | bugzilla.redhat.com/ |
| github. | github.com/ |
