CRIU vulnerabilities

The service daemon in CRIU creates log and dump files insecurely, allowing local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.

CRIU before 4.2.1 injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over the injection point, redirecting execution to an attacker-controlled callback when CRIU resumes the process.

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection, allowing it to spoof process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs.