Executive brief
A vulnerability in the CRIU utility, which is used for freezing and migrating running containers, could allow a malicious process to gain administrative privileges. By manipulating how the system saves the state of a running program, an attacker can trick the tool into granting the process full system capabilities when it is restarted. While serious, the risk is mitigated in many enterprise environments like OpenShift where security features like SELinux and user namespaces are active by default.
Technical details
A vulnerability exists in CRIU's 'compel' component regarding the handling of Restartable Sequences (rseq). When CRIU injects parasite code into a process for checkpointing, a malicious process can register an rseq critical section with a crafted abort handler. This handler can intercept the parasite's execution and patch the 'dump_creds' function to return spoofed credentials (UID 0, full capabilities). Upon restoration, CRIU applies these corrupted credentials to the process. The attack requires the attacker to have code execution within a container and for the host to initiate a checkpoint/restore operation. A fix has been merged into the CRIU development branch to properly abort rseq critical sections before parasite injection.
Affected products
- Checkpoint/Restore In Userspace (CRIU) CRIU
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-07-19: patched: Fix merged in CRIU GitHub pull request 3097
- 2026-07-28: disclosed: CVE published and Red Hat bugzilla entry created