Katexochen

**Name of the Vulnerable Software and Affected Versions** Contrast versions prior to 1.18.0 **Description** The guest kernel's ACPI/AML handling is susceptible to an AML injection attack known as BadAML. ACPI tables containing AML bytecode are transmitted from the untrusted host (QEMU) to the guest firmware (OVMF) and subsequently to the Linux kernel, where the AML interpreter executes them. An attacker with host control can create a table with malicious, Turing-complete AML bytecode. When the guest kernel interprets this bytecode, it gains access to the entire guest memory, including private pages, leading to arbitrary code execution and the potential disclosure or modification of confidential guest data. This issue specifically affects the AMD SEV-SNP platforms Metal-QEMU-SNP and Metal-QEMU-SNP-GPU. **Recommendations** Update to version 1.18.0.

**Name of the Vulnerable Software and Affected Versions** Contrast versions prior to 1.12.1 **Description** The secure persistent volume feature is susceptible to an attack where a malicious host provides a crafted LUKS2 volume to a pod VM. This occurs because LUKS2 volume metadata is not authenticated and `cryptsetup` versions prior to 2.8.1 accept a header specifying the null keyslot encryption algorithm (`cipher null-ecb`) without error. The Contrast Initializer assumes a device is protected if the `cryptsetup open` function succeeds with the secret seed. Consequently, the guest may open the attacker-supplied volume and write secret data in plaintext or using a volume key known to the attacker, enabling the host to read confidential data. **Recommendations** Update to version 1.12.1 or later.

**Name of the Vulnerable Software and Affected Versions** Edgelesssys Contrast versions 1.9.0 through 1.12.1 **Description** The initializer logs the full NewMeshCert response to standard output at the INFO level. This response contains the workload secret, making it accessible to any Kubernetes user with permissions to get or list pod logs. Since these workload secrets are utilized for Vault integration and encrypted storage, these components are also considered compromised. **Recommendations** Update Edgelesssys Contrast to version 1.12.2 or later.

**Name of the Vulnerable Software and Affected Versions** Contrast versions prior to 1.9.1 **Description** On bare-metal deployments, an untrusted host can write arbitrary file trees below a mount point inside a confidential container if the image declares at least one VOLUME (specified via the `config.volumes` in the OCI image configuration) for which no Kubernetes mount exists. This occurs because containerd adds a mount point when Kubernetes sets none, allowing the runtime to push data to the Kata agent, which compromises the integrity of directories critical to application functionality. **Recommendations** Update to version 1.9.1, which disallows this configuration in `contrast generate`.

**Name of the Vulnerable Software and Affected Versions** Contrast (Edgeless Systems) versions prior to 1.8.1 **Description** The Contrast initializer logs the workload secret to stderr, which directs the information into Kubernetes logs. This occurs when the `CONTRAST LOG LEVEL` variable is set to info or debug. Since info is the default setting, most installations are affected. This issue exposes workload secrets to Kubernetes users with permissions to get or list pods/logs, as well as entities with read access to the Kubernetes log storage, such as cloud providers. **Recommendations** Update Contrast (Edgeless Systems) to version 1.8.1 or later. As a temporary mitigation, change the `CONTRAST LOG LEVEL` variable to a level other than info or debug.

**Name of the Vulnerable Software and Affected Versions** Contrast versions prior to 1.4.1 **Description** A recovering Coordinator fails to verify the seed provided by the recovering party. This allows an attacker to establish a rogue Coordinator with a validated manifest but an attacker-controlled secret seed. If network traffic is redirected to this rogue Coordinator, an attacker can impersonate a workload owner if the owner sets a new manifest without comparing the returned root CA certificate to the existing one or verifies the Coordinator without a trusted reference. Consequently, the attacker can issue certificates chaining to the rogue Coordinator's root CA to recover workload secrets for workloads deployed after the attack. **Recommendations** Update to version 1.4.1 or later.