Insecure Volume Mount in Edgeless Systems' Kubernetes Runtime

CVE-2025-71424

What is CVE-2025-71424?

Edgeless Systems' Contrast, a runtime for confidential containers on Kubernetes, versions up to and including 1.9.0, exhibits a vulnerability where the VOLUME directive defined in a Dockerfile does not enforce secure mounting practices. This oversight allows untrusted hosts to manipulate file systems within confidential containers, specifically in bare-metal deployments. The vulnerability arises when a container image declares a VOLUME, but no corresponding mount exists in the Kubernetes configuration, enabling unauthorized write access to important directories within the application. The issue was addressed in version 1.9.1, which prohibits this potentially dangerous configuration.

References