-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/edgelesssys/contrast | go | < 1.9.1 | 1.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the genpolicy tool, which is part of the contrast project. Specifically, when a container image defined a VOLUME in its configuration and no corresponding volume mount was specified in the Kubernetes pod definition, genpolicy would automatically create a policy for a bind mount. This bind mount would map a directory from the host filesystem into the container at the path specified by the VOLUME directive. This behavior could be exploited by a malicious actor with control over the host to inject arbitrary files and directories into the container's filesystem, leading to a potential compromise of the containerized application.
The patch addresses this vulnerability by changing the behavior of the genpolicy tool. Instead of creating an implicit and potentially insecure bind mount, the updated code in yaml::get_container_mounts_and_storages now checks if every VOLUME declared in the image has a corresponding volume mount defined in the Kubernetes configuration. If any VOLUME is found without an explicit mount, the policy generation process will fail with a panic, forcing the user to explicitly configure a volume (e.g., an emptyDir) for that path. This change eliminates the possibility of the host injecting data through an implicitly created mount. The core vulnerable logic, which created the mount, was located in mount_and_storage::get_image_mount_and_storage, and this function was entirely removed by the patch.
KEV Misses 88% of Exploited CVEs- Get the report