Vulnerability DatabaseGHSA-phhq-63jg-fp7r

GHSA-phhq-63jg-fp7r:
vulnerability analysis and mitigation

Overview

The vulnerability (GHSA-phhq-63jg-fp7r) affects the Contrast software package, specifically versions prior to 1.9.1. Discovered and disclosed on July 9, 2025, this vulnerability relates to how Contrast handles VOLUME directives in Dockerfiles and config.volumes fields in OCI image descriptors. The issue affects bare metal Contrast deployments where images with VOLUME directives are used without explicit Kubernetes mounts (GitHub Advisory).

Technical details

The vulnerability stems from how containerd implements the conversion logic for VOLUME directives. While these paths have special semantics in Docker, they are only treated as hints in the OCI spec and not specially handled by Kubernetes. When no Kubernetes mount is set, containerd adds a mount point, but the specification doesn't define what data should populate these mount points. This implementation allows the runtime to push arbitrary data to the Kata agent. The vulnerability has been assigned a CVSS score of 3.5 (Low severity) with a vector string of CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (GitHub Advisory).

Impact

The vulnerability impact requires three specific conditions to be met: a bare metal Contrast deployment (AKS is not affected), an image with at least one VOLUME directive, and no Kubernetes mount at the path of the VOLUME. When these conditions are satisfied, the host gains the ability to write arbitrary directory trees below the mount point. This is particularly concerning as VOLUME locations are often crucial to an application's core functionality, and having untrusted data in these locations can compromise the application's security (GitHub Advisory).

Mitigation and workarounds

The vulnerability has been patched in version 1.9.1 by disallowing this configuration in contrast generate. For users unable to update immediately, two workarounds are available: explicitly mount an emptyDir to all VOLUME locations, or modify the image to remove the config.volumes entries if initial data in these locations is needed by the application (GitHub Advisory).