Summary
Kyverno reads notary signature layers via Layer.Uncompressed() and buffers the full uncompressed content into memory without a size limit. The code checks Layer.Size() (compressed size) but does not enforce a cap on uncompressed size, so a small compressed layer can decompress to a very large payload. In an admission-controller deployment, an attacker who can publish referrers or signatures for an image can trigger Kyverno to allocate excessive memory while evaluating image verification, causing OOM kills and denial of service.
Impact
The vulnerability affects the FetchSignatureBlob function in pkg/notary/repository.go. After performing size checks on the compressed blob, Kyverno calls signatureBlobLayer.Uncompressed() and reads the full stream into a bytes.Buffer via ReadFrom without any upper bound. An attacker-controlled layer can decompress far beyond the existing maxPayloadSize limit of 10,000,000 bytes, forcing Kyverno to allocate memory proportional to the uncompressed size. The impact is availability-only; exploitation requires the attacker to control registry referrer or signature artifacts for an image evaluated under an image verification policy.
Detection
There is no public Falco rule or specific log pattern documented for this advisory. Review Kyverno admission controller pod memory metrics and Kubernetes events for OOM kills of Kyverno pods. Examine Kyverno controller logs for errors in image verification code paths involving notary signatures. Audit all image verification policies to identify those that process notary signatures and restrict them to trusted registries as a temporary measure pending upgrade.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which enforces an upper bound on uncompressed reads. Until the upgrade is complete, restrict image verification policies to trusted internal registries to limit the attack surface. The advisory also notes that additional callsites with the same pattern exist in pkg/cosign/sigstore.go and pkg/notary/notary.go and likely require the same fix for complete remediation.