From d0a19d60665861c9ccc1b60c59d20d4aa913b0de Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 02:44:21 +0200 Subject: [PATCH] Record ungraded user runtime OS findings pending informed disposition Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- ...-F-0016-user-engine-os-runtime-findings.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 findings/RISK-F-0016-user-engine-os-runtime-findings.md diff --git a/findings/RISK-F-0016-user-engine-os-runtime-findings.md b/findings/RISK-F-0016-user-engine-os-runtime-findings.md new file mode 100644 index 0000000..1bc2111 --- /dev/null +++ b/findings/RISK-F-0016-user-engine-os-runtime-findings.md @@ -0,0 +1,21 @@ +--- +id: RISK-F-0016 +type: finding +title: "Published User Engine readback candidate retains 44 scanner HIGH OS occurrences" +status: open +reported_by: user-engine +reported_via: rapp-user-engine +date_reported: "2026-10-11" +system: user-engine +environment: build +fix_owner: user-engine +fix_tracking: RAPP-USER-ENGINE-WP-0004 +--- + +Exact image forgejo.coulomb.social/coulomb/user-engine@sha256:f239bbf332b8eb87320c86390fddca1dcb4f7c628a7af75e79dee8058d446a7b has 44 Trivy HIGH package/CVE occurrences across eight unique CVEs and zero CRITICAL. No FixedVersion is advertised for those scanned Trixie packages; upstream/Sid fixes do exist. Scan SHA256 17b793f13bd19fa87bba840ced3c9c40a78a78feda569019e92c347dc7f3e76a, no severity suppression or ignore-unfixed. Source image revision1bb7cacc98479f56f6b1c28c000479efd260a944; native CI repair ac8b04edc7ae51492ee2e19e1ff075cf37e6708b passed without runtime input changes. + +Exposure is not established as exploitable or impossible. mount/setuid, nsenter, infocmp and Perl exist in the image; systemd-homed was absent at its standard path. Non-root/no-new-privileges/capability-drop/read-only/no-host-namespace controls constrain local utility paths, but do not eliminate application compromise, denial of service or mounted credential exposure. Focused source review is not a complete exploit/call-graph analysis. + +Full eight-CVE package mapping, primary Debian links, caveats and prepared image/baseline receipts: rapp-user-engine/docs/evidence/2026-10-11-published-readback-proposal/risk-assessment.md. Custodian independently retained actual published image verification and exact scan in docs/evidence/2026-10-10-security-consolidation/published-user-runtime. Local failed scan/image candidates remain historical. + +Suggested direction: exact short build-mode trial only if the supervisor explicitly accepts bounded residual risk; otherwise defer, or prepare supported-base/package-pruning changes with complete tests/provenance/scan. NetKingdom is the package binding residual risk owner; RiskNexus grades/routes this finding. Filing and source preparation are not acceptance. Proposed review by October18 is the trial condition, not a reporter-assigned RiskNexus cadence. No live rollout has occurred under this proposal.