coulomb/risk-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record ungraded user runtime OS findings pending informed disposition

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:44:21 +02:00
parent b5b80aafca
commit d0a19d6066
1 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
findings/RISK-F-0016-user-engine-os-runtime-findings.md Normal file
View file

@ -0,0 +1,21 @@
---
id: RISK-F-0016
type: finding
title: "Published User Engine readback candidate retains 44 scanner HIGH OS occurrences"
status: open
reported_by: user-engine
reported_via: rapp-user-engine
date_reported: "2026-10-11"
system: user-engine
environment: build
fix_owner: user-engine
fix_tracking: RAPP-USER-ENGINE-WP-0004
---
Exact image forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b has 44 Trivy HIGH package/CVE occurrences across eight unique CVEs and zero CRITICAL. No FixedVersion is advertised for those scanned Trixie packages; upstream/Sid fixes do exist. Scan SHA256 17b793f13bd19fa87bba840ced3c9c40a78a78feda569019e92c347dc7f3e76a, no severity suppression or ignore-unfixed. Source image revision1bb7cacc98479f56f6b1c28c000479efd260a944; native CI repair ac8b04edc7ae51492ee2e19e1ff075cf37e6708b passed without runtime input changes.
Exposure is not established as exploitable or impossible. mount/setuid, nsenter, infocmp and Perl exist in the image; systemd-homed was absent at its standard path. Non-root/no-new-privileges/capability-drop/read-only/no-host-namespace controls constrain local utility paths, but do not eliminate application compromise, denial of service or mounted credential exposure. Focused source review is not a complete exploit/call-graph analysis.
Full eight-CVE package mapping, primary Debian links, caveats and prepared image/baseline receipts: rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/risk-assessment.md. Custodian independently retained actual published image verification and exact scan in docs/evidence/2026-10-10-security-consolidation/published-user-runtime. Local failed scan/image candidates remain historical.
Suggested direction: exact short build-mode trial only if the supervisor explicitly accepts bounded residual risk; otherwise defer, or prepare supported-base/package-pruning changes with complete tests/provenance/scan. NetKingdom is the package binding residual risk owner; RiskNexus grades/routes this finding. Filing and source preparation are not acceptance. Proposed review by October18 is the trial condition, not a reporter-assigned RiskNexus cadence. No live rollout has occurred under this proposal.