Summary
An unchecked type assertion in Kyverno's image-verification engine allows an attacker who controls a container image or its OCI referrers to crash the Kyverno policy engine with a Go panic. In the admission path this turns image verification into a silent bypass for any policy using failurePolicy: Ignore; in the reports-controller it produces a persistent crash-loop (denial of service) that lasts as long as the malicious image remains referenced in the cluster. No signing key or authentication is required.
Impact
The vulnerability exists in buildStatementMap in pkg/engine/internal/utils.go, which asserts that the type field of every attestation statement is a string without first checking the type. The statements slice is built directly from the raw OCI manifest JSON of a referrer in the Notary verifier, which is fully attacker-controlled. A manifest whose type field is any non-string JSON value — such as an integer — passes the existing nil guard in the Notary verifier and subsequently triggers the panic in buildStatementMap. In the admission webhook path, net/http recovers the panic as a webhook error; for any policy with failurePolicy: Ignore, the admission request proceeds without image verification, constituting a silent policy bypass. In the reports-controller path, the crash-loop persists for as long as the malicious image remains referenced in the cluster, resulting in sustained denial of service for policy reporting.
Detection
Kyverno logs the recovered panic as an internal server error in the policy-engine pod. Operators should monitor admission webhook error rates and the Kyverno policy-engine pod restart count; repeated CrashLoopBackOff events for the reports-controller combined with webhook admission errors for image-verified workloads are indicators of exploitation. Review Kubernetes API server audit logs for admission webhook timeout and failure events on namespaces governed by Kyverno verifyImages policies. Consult the upstream advisory at the reference URL for additional detail.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which contains the fix for this vulnerability. No documented workaround fully prevents exploitation. As a temporary measure, switching verifyImages rules from failurePolicy: Ignore to failurePolicy: Fail prevents the silent bypass at the cost of potentially blocking admissions if the webhook encounters errors.
Related Security Guidance
References
- GHSA-24cc-9745-hxfc — Kyverno Security Advisory