Confidential Containers Guest Components versions >=0.16.0 and <0.20.0 contain a path traversal vulnerability in the image unpacking function image_rs::stream::unpack::unpack(). The vulnerability arises because the function try_hardlink_fallback() validates the hardlink source but constructs the destination path using Rust's Path::join with an entry relative path that can be absolute. This allows an attacker to create a hardlink pointing outside the intended directory, writing attacker-controlled content to arbitrary absolute paths. Since the workload owner controls trusted image content, this vulnerability enables an escape from the workload into the pod virtual machine, potentially allowing access to VM capabilities and attestation abuse. The vulnerability is addressed in version 0.20.0.

An attacker controlling the OCI image layer can exploit this vulnerability to write files outside the intended directory in the pod virtual machine. This constitutes a workload-owner escape into the pod VM, potentially enabling unauthorized access to VM capabilities and misuse of attestation mechanisms. The confidentiality and integrity of the pod VM environment may be partially compromised. There is no indication of availability impact. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and partial confidentiality and integrity impact.

This vulnerability is fixed in Confidential Containers Guest Components version 0.20.0. Users should upgrade to version 0.20.0 or later to remediate this issue. No other mitigation or temporary workaround is indicated.