Burgerdev

**Name of the Vulnerable Software and Affected Versions** Contrast versions 1.14.0 through 1.23.0 **Description** Runtime policies are generated that fail to detect all container image substitutions. This occurs because an `allow storage` rule accepts storage entries using the `image guest pull` driver without verifying the image digest. An attacker with access to the Kata agent API can substitute a container image with an exploit payload, provided the substituted image satisfies the remaining policy rules, which undermines the integrity guarantees of the confidential container. **Recommendations** Update Contrast to version 1.23.1.

**Name of the Vulnerable Software and Affected Versions** Contrast versions prior to 1.9.1 **Description** On bare-metal deployments, an untrusted host can write arbitrary file trees below a mount point inside a confidential container if the image declares at least one VOLUME (specified via the `config.volumes` in the OCI image configuration) for which no Kubernetes mount exists. This occurs because containerd adds a mount point when Kubernetes sets none, allowing the runtime to push data to the Kata agent, which compromises the integrity of directories critical to application functionality. **Recommendations** Update to version 1.9.1, which disallows this configuration in `contrast generate`.

**Name of the Vulnerable Software and Affected Versions** Contrast (Edgeless Systems) versions prior to 1.8.1 **Description** The Contrast initializer logs the workload secret to stderr, which directs the information into Kubernetes logs. This occurs when the `CONTRAST LOG LEVEL` variable is set to info or debug. Since info is the default setting, most installations are affected. This issue exposes workload secrets to Kubernetes users with permissions to get or list pods/logs, as well as entities with read access to the Kubernetes log storage, such as cloud providers. **Recommendations** Update Contrast (Edgeless Systems) to version 1.8.1 or later. As a temporary mitigation, change the `CONTRAST LOG LEVEL` variable to a level other than info or debug.

**Name of the Vulnerable Software and Affected Versions** Contrast versions prior to 1.4.1 **Description** A recovering Coordinator fails to verify the seed provided by the recovering party. This allows an attacker to establish a rogue Coordinator with a validated manifest but an attacker-controlled secret seed. If network traffic is redirected to this rogue Coordinator, an attacker can impersonate a workload owner if the owner sets a new manifest without comparing the returned root CA certificate to the existing one or verifies the Coordinator without a trusted reference. Consequently, the attacker can issue certificates chaining to the rogue Coordinator's root CA to recover workload secrets for workloads deployed after the attack. **Recommendations** Update to version 1.4.1 or later.