Summary
Kyverno fetches notary attestations (referrers) and extracts statement predicates by reading Layer.Uncompressed() into a bytes.Buffer without an uncompressed-size limit. The code checks Layer.Size() and descriptor sizes for compressed blobs but does not enforce a cap on the uncompressed bytes read from Uncompressed(). In an admission-controller deployment, an attacker who can supply registry artifacts for an image's referrers can cause Kyverno to allocate excessive memory while fetching attestations, potentially triggering an OOM kill and denial of service.
Impact
The vulnerability is in the extractStatement function at pkg/notary/notary.go:337. After performing compressed-size checks, Kyverno calls layer.Uncompressed() and reads the full stream into a bytes.Buffer via ReadFrom without any upper bound. An attacker-controlled predicate layer can decompress far beyond the existing maxPayloadSize limit of 10,000,000 bytes, forcing Kyverno to allocate memory proportional to the uncompressed size. The impact is availability-only; exploitation requires the attacker to control registry referrer or attestation artifacts for an image evaluated under a notary attestation policy.
Detection
There is no public Falco rule or specific log pattern documented for this advisory. Review Kyverno admission controller pod memory metrics and Kubernetes events for OOM kills. Examine Kyverno controller logs for errors in attestation fetch code paths involving notary. Audit policies that fetch notary attestations and restrict them to trusted registries as a temporary measure pending upgrade.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which enforces an upper bound on uncompressed reads. Until the upgrade is complete, restrict image verification policies that fetch notary attestations to trusted internal registries to limit the attack surface.