how to avoid attack on Certificate Revocation List by the owner of the private key?
Yes one could do this, the repudiation wouldn't be very convincing.

The CRL really isn't very relevant. A person can always claim his private key was stolen. His credit card was stolen or his car was stolen. 
We see people commit hit and run, realize what they have done park the car somewhere and report it stolen. Denying a credit card transaction etc.
If the car is reported stolen well before the hit and run that would be convincing proof.

As with CRL it would be convincing if the revocation is clearly before the transaction. But a revocation very close in time to the transaction doesn't provide a very convincing repudation though theft is plausible it is not common. And the private key owner could still be held responsible for his private key. 

CRLs should not waive responsibility the second they are posted.