OpenShift Sandboxed Containers - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openshift-sandboxed-containers/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 18:45:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenShift Sandboxed Containers: Confidential computing bypass via systemd-gpt-auto-generator (CVE-2026-121876)https://feed.craftedsignal.io/briefs/2026-11-openshift-gpt-auto-generator-vulnerability-cve-2026-121876/Thu, 12 Nov 2026 18:45:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openshift-gpt-auto-generator-vulnerability-cve-2026-121876/A vulnerability in systemd-gpt-auto-generator in OpenShift Sandboxed Containers allows a malicious host to bypass TEE encryption by injecting unauthorized partitions that force sensitive guest memory to be paged to host-controlled storage.A flaw exists in how the systemd-gpt-auto-generator handles GPT partition discovery within OpenShift Sandboxed Containers (confidential peer pods). In environments using AMD SEV-SNP or Intel TDX, the confidential computing threat model assumes the host is untrusted. The generator automatically discovers and mounts GPT partitions at boot without user interaction. A malicious host can inject unauthorized partitions, such as a swap partition, into the guest VM's virtual disk. This forces the guest kernel to page out TEE-encrypted memory to host-controlled storage, effectively breaking the confidentiality guarantees of the hardware TEE.

Impact

Successful exploitation allows a malicious host to access sensitive, encrypted memory contents from the guest VM. The vulnerability is unmitigated by existing roothash= kernel parameters, which only protect the root partition. Furthermore, the current remote attestation process (measuring PCRs 3, 9, 11, and 12) does not measure the GPT partition table (PCR 5), meaning partition table modifications remain undetected.

]]>highadvisory