This bytecode is passed to the guest firmware (OVMF) and subsequently executed by the guest Linux kernel's AML interpreter. Because the interpreter lacks sufficient isolation in older versions, it can access the full guest memory space, including private memory pages. This allows the host adversary to perform unauthorized reads or modifications of sensitive guest data and achieve arbitrary code execution within the guest. This issue specifically affects AMD SEV-SNP platforms, including Metal-QEMU-SNP and Metal-QEMU-SNP-GPU, whereas Intel TDX environments are protected by measurements in RTMR 0. Version 1.18.0 addresses this by sandboxing the AML interpreter.

Impact

Successful exploitation allows a malicious host to break the confidentiality and integrity guarantees of the confidential-computing runtime. An attacker can gain arbitrary code execution inside the guest container or virtual machine, facilitating the exfiltration or modification of private memory contents. This impacts users running sensitive workloads on AMD SEV-SNP platforms using the affected versions of the Contrast runtime.

Recommendation

Prioritize the upgrade of all Contrast runtime instances running on AMD SEV-SNP platforms to version 1.18.0 or later to ensure the kernel AML interpreter is properly sandboxed. Given the fundamental nature of this vulnerability in ACPI handling, monitor for unexpected kernel-level activity originating from the ACPI subsystem, although detection at the guest level may be difficult due to the nature of the exploit.

Impact

The vulnerability poses a high risk to Kubernetes workloads using Contrast for confidential computing. If exploited, an attacker can access sensitive workload secrets. While the legitimate Coordinator's internal secrets (such as its own seed and CA) remain secure, the exposure of workload-specific secrets impacts the confidentiality of data-in-use for services deployed within the compromised mesh.

Recommendation

• Upgrade the Contrast Kubernetes runtime to version 1.4.1 or later to remediate CVE-2025-71426.
• Audit Kubernetes network policies to restrict unauthorized traffic redirection to sensitive control plane components.
• Mandate strict verification of root CA certificates for all Coordinator communication, ensuring they are compared against known-good trusted references rather than relying on default CLI behavior.