Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting

Summary

A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.

Timeline

1. Jan 28, 2025, 9:29 AM UTCCVE published
2. Jan 28, 2025, 2:36 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 30, 2026, 6:13 PM UTCRecord last updated

Affected versions

• cri-o

  fixed in 1.33.1

• cri-o

  Version range not reported

• buildah

  Version range not reported

• conmon

  Version range not reported

• conmon-rs

  Version range not reported

• containers-common

  Version range not reported

• container-selinux

  Version range not reported

• cri-o

  Version range not reported

• cri-tools

  Version range not reported

• crudini

  Version range not reported

• crun

  Version range not reported

• golang-github-prometheus-promu

  Version range not reported

• haproxy

  Version range not reported

• ignition

  Version range not reported

• kernel

  Version range not reported

• libreswan

  Version range not reported

• openshift

  Version range not reported

• openshift4-aws-iso

  Version range not reported

• openshift-ansible

  Version range not reported

• openshift-clients

  Version range not reported

• ose-aws-ecr-image-credential-provider

  Version range not reported

• ose-azure-acr-image-credential-provider

  Version range not reported

• ose-gcp-gcr-image-credential-provider

  Version range not reported

• ovn24.09

  Version range not reported

• podman

  Version range not reported

• pyOpenSSL

  Version range not reported

• pysnmp

  Version range not reported

• pysnmp-lextudio

  Version range not reported

• python-alembic

  Version range not reported

• python-amqp

  Version range not reported

• python-automaton

  Version range not reported

• python-autopage

  Version range not reported

• python-bcrypt

  Version range not reported

• python-beautifulsoup4

  Version range not reported

• python-binary-memcached

  Version range not reported

• python-cachetools

  Version range not reported

• python-cinderclient

  Version range not reported

• python-click

  Version range not reported

• python-cliff

  Version range not reported

• python-cmd2

  Version range not reported

• python-colorama

  Version range not reported

• python-construct

  Version range not reported

• python-contextlib2

  Version range not reported

• python-ddt

  Version range not reported

• python-debtcollector

  Version range not reported

• python-decorator

  Version range not reported

• python-defusedxml

  Version range not reported

• python-dogpile-cache

  Version range not reported

• python-dracclient

  Version range not reported

• python-editor

  Version range not reported

• python-eventlet

  Version range not reported

• python-fasteners

  Version range not reported

• python-fixtures

  Version range not reported

• python-flask

  Version range not reported

• python-funcsigs

  Version range not reported

• python-futurist

  Version range not reported

• python-gevent

  Version range not reported

• python-glanceclient

  Version range not reported

• python-greenlet

  Version range not reported

• python-gunicorn

  Version range not reported

• python-hardware

  Version range not reported

• python-html5lib

  Version range not reported

• python-ifaddr

  Version range not reported

• python-importlib-metadata

  Version range not reported

• python-ironicclient

  Version range not reported

• python-ironic-prometheus-exporter

  Version range not reported

• python-iso8601

  Version range not reported

• python-itsdangerous

  Version range not reported

• python-jinja2

  Version range not reported

• python-jsonpath-rw

  Version range not reported

• python-jsonschema

  Version range not reported

• python-kazoo

  Version range not reported

• python-keyring

  Version range not reported

• python-keystoneauth1

  Version range not reported

• python-keystoneclient

  Version range not reported

• python-keystonemiddleware

  Version range not reported

• python-kombu

  Version range not reported

• python-logutils

  Version range not reported

• python-markupsafe

  Version range not reported

• python-memcached

  Version range not reported

• python-microversion-parse

  Version range not reported

• python-migrate

  Version range not reported

• python-msgpack

  Version range not reported

• python-munch

  Version range not reported

• python-netaddr

  Version range not reported

• python-neutronclient

  Version range not reported

• python-openstacksdk

  Version range not reported

• python-osc-lib

  Version range not reported

• python-os-client-config

  Version range not reported

• python-oslo-cache

  Version range not reported

• python-oslo-concurrency

  Version range not reported

• python-oslo-config

  Version range not reported

• python-oslo-context

  Version range not reported

• python-oslo-db

  Version range not reported

• python-oslo-i18n

  Version range not reported

• python-oslo-log

  Version range not reported

• python-oslo-messaging

  Version range not reported

• python-oslo-metrics

  Version range not reported

• python-oslo-middleware

  Version range not reported

• python-oslo-policy

  Version range not reported

• python-oslo-reports

  Version range not reported

• python-oslo-rootwrap

  Version range not reported

• python-oslo-serialization

  Version range not reported

• python-oslo-service

  Version range not reported

• python-oslo-upgradecheck

  Version range not reported

• python-oslo-utils

  Version range not reported

• python-oslo-versionedobjects

  Version range not reported

• python-osprofiler

  Version range not reported

• python-os-service-types

  Version range not reported

• python-os-traits

  Version range not reported

• python-paste

  Version range not reported

• python-paste-deploy

  Version range not reported

• python-pbr

  Version range not reported

• python-pecan

  Version range not reported

• python-pexpect

  Version range not reported

• python-pint

  Version range not reported

• python-platformdirs

  Version range not reported

• python-proliantutils

  Version range not reported

• python-prometheus_client

  Version range not reported

• python-pyasn1

  Version range not reported

• python-pycadf

  Version range not reported

• python-pyperclip

  Version range not reported

• python-redis

  Version range not reported

• python-repoze-lru

  Version range not reported

• python-requestsexceptions

  Version range not reported

• python-requests-unixsocket

  Version range not reported

• python-retrying

  Version range not reported

• python-rfc3986

  Version range not reported

• python-routes

  Version range not reported

• python-scciclient

  Version range not reported

• python-SecretStorage

  Version range not reported

• python-setuptools

  Version range not reported

• python-simplegeneric

  Version range not reported

• python-simplejson

  Version range not reported

• python-singledispatch

  Version range not reported

• python-smi

  Version range not reported

• python-smi-lextudio

  Version range not reported

• python-soupsieve

  Version range not reported

• python-sqlalchemy

  Version range not reported

• python-sqlparse

  Version range not reported

• python-statsd

  Version range not reported

• python-stevedore

  Version range not reported

• python-sushy-oem-idrac

  Version range not reported

• python-swiftclient

  Version range not reported

• python-tempita

  Version range not reported

• python-tenacity

  Version range not reported

• python-tooz

  Version range not reported

• python-uhashring

  Version range not reported

• python-vine

  Version range not reported

• python-voluptuous

  Version range not reported

• python-waitress

  Version range not reported

• python-warlock

  Version range not reported

• python-wcwidth

  Version range not reported

• python-webencodings

  Version range not reported

• python-webob

  Version range not reported

• python-webtest

  Version range not reported

• python-werkzeug

  Version range not reported

• python-wrapt

  Version range not reported

• python-wsme

  Version range not reported

• python-yappi

  Version range not reported

• python-zake

  Version range not reported

• python-zeroconf

  Version range not reported

• python-zipp

  Version range not reported

• python-zope-event

  Version range not reported

• python-zope-interface

  Version range not reported

• runc

  Version range not reported

• skopeo

  Version range not reported

• toolbox

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• github.com/cri-o/cri-oGo

  through 1.33.0

• github.com/cri-o/cri-oGo

  All versions

References 4