Compliance Impact

This vulnerability in Trivy causes a denial of service (DoS) condition by exhausting memory resources when scanning malicious Helm chart archives. It does not impact the confidentiality or integrity of data.

Since the vulnerability does not lead to unauthorized data access, disclosure, or modification, it does not directly affect compliance with data protection standards such as GDPR or HIPAA.

However, the denial of service could disrupt security scanning processes in CI environments, potentially delaying vulnerability detection and remediation, which might indirectly affect compliance posture if security controls are not properly maintained.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Trivy, a security scanner, in versions prior to 0.71.0. When Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry without imposing a size limit. An attacker who can place a malicious .tgz file in the scanned path can create a small compressed archive that decompresses into gigabytes of data. This excessive decompression causes the Trivy process to consume too much memory and be terminated by the operating system's Out-Of-Memory (OOM) killer.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service condition. By causing Trivy to decompress a maliciously crafted archive that expands to a very large size, the Trivy process can be killed by the OS due to excessive memory usage. This means that scanning operations can be disrupted or halted, potentially preventing security assessments from completing successfully.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Trivy to version 0.71.0 or later, where the issue with the custom tar unpacker reading entries without size limits has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when Trivy scans a Helm chart archive (.tgz) that decompresses to an excessively large size, causing an out-of-memory (OOM) condition. To detect if your system is affected, you can check if Trivy processes are being killed by the OS OOM killer during scans of Helm chart archives.

You can monitor your system logs for OOM killer events related to Trivy. For example, on Linux systems, you can use the following command to check the kernel log for OOM kills:

• dmesg | grep -i 'killed process' | grep trivy

Additionally, you can check running Trivy versions to identify if they are older than 0.71.0, which are vulnerable:

• trivy --version

To detect malicious or unusually large Helm chart archives in your scanned directories, you can list .tgz files and check their uncompressed sizes. For example:

• tar -tzf suspicious-chart.tgz | xargs -I{} tar -xOf suspicious-chart.tgz {} | wc -c

However, since the vulnerability is triggered by decompressing archives that expand to gigabytes, monitoring memory usage of Trivy during scans can also help detect exploitation attempts.

Useful 0 Not Useful 0