GMS-2022-1472: Ignition config accessible to unprivileged software on VMware

May 25, 2022 (updated June 8, 2022)

Unprivileged software in VMware VMs, including software running in unprivileged containers, can retrieve an Ignition config stored in a hypervisor guestinfo variable or OVF environment.

References

github.com/advisories/GHSA-hj57-j5cw-2mwp
github.com/coreos/ignition/issues/1300
github.com/coreos/ignition/pull/1350
github.com/coreos/ignition/security/advisories/GHSA-hj57-j5cw-2mwp

Code Behaviors & Features

Detect and mitigate GMS-2022-1472 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →