CyberRota Analysis
AI-GeneratedThe vulnerability affects Kraken agents, which inadequately verify peer-to-peer downloaded blobs by relying solely on CRC32 checksums instead of validating against the requested SHA-256 digests. This flaw allows attackers to inject malicious content into the cache, potentially leading to the execution of compromised container images or manifests on other hosts. Organizations utilizing Kraken agents should prioritize addressing this critical vulnerability to prevent potential exploitation and ensure the integrity of their containerized environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.