Platform flag is being ignored when scanning an image #4310

FrimIdan · 2023-05-09T14:45:27Z

FrimIdan
May 9, 2023

Description

Running the following command succeeded although it should have failed (idanfrim/multi-arch:only-arm64 was built only for linux/arm64)

trivy -d image idanfrim/multi-arch:only-arm64 --platform=linux/amd64

#3571 might be related.

Also, after pulling the image to my local docker, the same command succeeded (so remote scan and dockerd scan have the same results)

$ docker inspect --format='{{.Architecture}}' idanfrim/multi-arch:only-arm64
arm64

What did you expect to happen?

I expected to get a failure since idanfrim/multi-arch:only-arm64 was not built for linux/amd64

What happened instead?

Scan passed

Output of run with `--debug`:

$ trivy -d image idanfrim/multi-arch:only-arm64 --platform=linux/amd64
2023-05-09T17:40:27.892+0300	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-05-09T17:40:27.978+0300	DEBUG	cache dir:  /Users/idanf/Library/Caches/trivy
2023-05-09T17:40:27.982+0300	DEBUG	DB update was skipped because the local DB is the latest
2023-05-09T17:40:27.983+0300	DEBUG	DB Schema: 2, UpdatedAt: 2023-05-09 12:33:58.253896005 +0000 UTC, NextUpdate: 2023-05-09 18:33:58.253895205 +0000 UTC, DownloadedAt: 2023-05-09 12:50:31.399577 +0000 UTC
2023-05-09T17:40:27.985+0300	INFO	Vulnerability scanning is enabled
2023-05-09T17:40:27.985+0300	DEBUG	Vulnerability type:  [os library]
2023-05-09T17:40:27.986+0300	INFO	Secret scanning is enabled
2023-05-09T17:40:27.986+0300	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-05-09T17:40:27.986+0300	INFO	Please see also https://aquasecurity.github.io/trivy/v0.41/docs/secret/scanning/#recommendation for faster secret detection
2023-05-09T17:40:30.370+0300	DEBUG	No secret config detected: trivy-secret.yaml
2023-05-09T17:40:31.405+0300	DEBUG	Image ID: sha256:4c0f16b38ec04b778e71c1624309a6672ac3441a8144f9bd7cb7b155fe53ef5b
2023-05-09T17:40:31.405+0300	DEBUG	Diff IDs: [sha256:b49483f6a0e69237cf32ba9fe9171f66eb70c00307ec3f3075564c10349774c3 sha256:3e6cb914e6df40686aa290a1b99764fdb2f096f2d13f8c92873efc1dd17a1f37 sha256:4978503d5487f000bb42c5786ac40f8c3a5f948affc336c3034c40bf1cf718ff sha256:08b64397f7ccb542c234a622efcf951cd5feb07a1470971c34b2398202ff2a80]
2023-05-09T17:40:31.405+0300	DEBUG	Base Layers: [sha256:b49483f6a0e69237cf32ba9fe9171f66eb70c00307ec3f3075564c10349774c3]
2023-05-09T17:40:31.405+0300	DEBUG	Missing image ID in cache: sha256:4c0f16b38ec04b778e71c1624309a6672ac3441a8144f9bd7cb7b155fe53ef5b
2023-05-09T17:40:31.405+0300	DEBUG	Missing diff ID in cache: sha256:08b64397f7ccb542c234a622efcf951cd5feb07a1470971c34b2398202ff2a80
2023-05-09T17:40:31.405+0300	DEBUG	Missing diff ID in cache: sha256:3e6cb914e6df40686aa290a1b99764fdb2f096f2d13f8c92873efc1dd17a1f37
2023-05-09T17:40:31.405+0300	DEBUG	Missing diff ID in cache: sha256:b49483f6a0e69237cf32ba9fe9171f66eb70c00307ec3f3075564c10349774c3
2023-05-09T17:40:31.405+0300	DEBUG	Missing diff ID in cache: sha256:4978503d5487f000bb42c5786ac40f8c3a5f948affc336c3034c40bf1cf718ff
2023-05-09T17:40:32.379+0300	DEBUG	Skipping directory: dev
2023-05-09T17:40:32.432+0300	DEBUG	Skipping directory: proc
2023-05-09T17:40:32.432+0300	DEBUG	Skipping directory: sys
2023-05-09T17:40:50.631+0300	DEBUG	No secrets found in container image config
2023-05-09T17:40:50.672+0300	INFO	Detected OS: ubuntu
2023-05-09T17:40:50.672+0300	INFO	Detecting Ubuntu vulnerabilities...
2023-05-09T17:40:50.672+0300	DEBUG	ubuntu: os version: 22.04
2023-05-09T17:40:50.672+0300	DEBUG	ubuntu: the number of packages: 116
2023-05-09T17:40:50.682+0300	INFO	Number of language-specific files: 0

idanfrim/multi-arch:only-arm64 (ubuntu 22.04)

Total: 16 (UNKNOWN: 0, LOW: 16, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────┬────────────────┬──────────┬──────────────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability  │ Severity │    Installed Version     │ Fixed Version │                            Title                            │
├──────────────┼────────────────┼──────────┼──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ bash         │ CVE-2022-3715  │ LOW      │ 5.1-6ubuntu1             │               │ a heap-buffer-overflow in valid_parameter_transform         │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3715                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781  │          │ 8.32-4.1ubuntu1          │               │ coreutils: Non-privileged session can escape to the parent  │
│              │                │          │                          │               │ session in chroot                                           │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-2781                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ gpgv         │ CVE-2022-3219  │          │ 2.2.27-3ubuntu2.1        │               │ gnupg: denial of service issue (resource consumption) using │
│              │                │          │                          │               │ compressed packets                                          │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-3219                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libc-bin     │ CVE-2016-20013 │          │ 2.35-0ubuntu3.1          │               │ sha256crypt and sha512crypt through 0.6 allow attackers to  │
│              │                │          │                          │               │ cause a denial of...                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2016-20013                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libc6        │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libncurses6  │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ libncursesw6 │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libpcre3     │ CVE-2017-11164 │          │ 2:8.39-13ubuntu0.22.04.1 │               │ pcre: OP_KETRMAX feature in the match function in           │
│              │                │          │                          │               │ pcre_exec.c                                                 │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2017-11164                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2023-1255  │          │ 3.0.2-0ubuntu1.9         │               │ Input buffer over-read in AES-XTS implementation on 64 bit  │
│              │                │          │                          │               │ ARM                                                         │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2023-1255                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libtinfo6    │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libzstd1     │ CVE-2022-4899  │          │ 1.4.8+dfsg-3build1       │               │ buffer overrun in util.c                                    │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-4899                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ login        │ CVE-2023-29383 │          │ 1:4.8.1-2ubuntu2.1       │               │ Improper input validation in shadow-utils package utility   │
│              │                │          │                          │               │ chfn                                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2023-29383                  │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ ncurses-base │ CVE-2022-29458 │          │ 6.3-2                    │               │ ncurses: segfaulting OOB read                               │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2022-29458                  │
├──────────────┤                │          │                          ├───────────────┤                                                             │
│ ncurses-bin  │                │          │                          │               │                                                             │
│              │                │          │                          │               │                                                             │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ openssl      │ CVE-2023-1255  │          │ 3.0.2-0ubuntu1.9         │               │ Input buffer over-read in AES-XTS implementation on 64 bit  │
│              │                │          │                          │               │ ARM                                                         │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2023-1255                   │
├──────────────┼────────────────┤          ├──────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ passwd       │ CVE-2023-29383 │          │ 1:4.8.1-2ubuntu2.1       │               │ Improper input validation in shadow-utils package utility   │
│              │                │          │                          │               │ chfn                                                        │
│              │                │          │                          │               │ https://avd.aquasec.com/nvd/cve-2023-29383                  │
└──────────────┴────────────────┴──────────┴──────────────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

Output of `trivy -v`:

Version: 0.41.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-05-09 12:33:58.253896005 +0000 UTC
  NextUpdate: 2023-05-09 18:33:58.253895205 +0000 UTC
  DownloadedAt: 2023-05-09 12:50:31.399577 +0000 UTC

Additional details (base image name, container registry info...):

knqyf263 · 2023-05-10T15:29:15Z

knqyf263
May 10, 2023
Maintainer

We need to discuss it since docker pull doesn't fail.

$ docker pull --platform=linux/amd64 idanfrim/multi-arch:only-arm64
only-arm64: Pulling from idanfrim/multi-arch
79d0ea7dc1a8: Pull complete
65b7d9a24173: Pull complete
b34ae7f18371: Pull complete
ee022a82a364: Pull complete
Digest: sha256:a62721eaf9f74bc995232c93432696c9eb76ee70f6359ee9d977adfe0e898cba
Status: Downloaded newer image for idanfrim/multi-arch:only-arm64
docker.io/idanfrim/multi-arch:only-arm64

We tried to mimic the behavior of Docker.

11 replies

FrimIdan May 22, 2023
Author

Not just pulling images, we can just build it locally

docker buildx build --platform linux/arm64 -t idanfrim/multi-arch:only-arm64 .

And try to scan it.
I think that if the docker daemon is used in the code, the platform verification (force) is skipped.

knqyf263 May 22, 2023
Maintainer

So, is this your expectation?

When passing --force-platform
- Scanning fails if the specified platform is not found in the container registry.
- Ignore --force-platform if the specified platform doesn't match the image found in the local daemon
Without passing --force-platform
- Scanning falls back to the default platform ( linux/amd64) if the specified platform is not found in the container registry.
- Ignore --platform for local images

FrimIdan May 22, 2023
Author

Ignore --force-platform if the specified platform doesn't match the image found in the local daemon

Not sure why to ignore, when passing --force-platform i would expect the scan to fail if the specified platform doesn't match the image found in the local daemon.

Without passing --force-platform

TBH, I think it should always be, if --platform was used and the platform doesn't exist in the registry/local the scan should fail, DYT?

knqyf263 May 22, 2023
Maintainer

Again, docker pull also ignores the specified platform if not found.

FrimIdan May 22, 2023
Author

I understand that, but here we want to scan an image, the platform probably affects the result.
When docker pull allows it, the worst thing that can happen is that the image will fail to run.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Platform flag is being ignored when scanning an image #4310

{{title}}

Replies: 1 comment 11 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Platform flag is being ignored when scanning an image #4310

FrimIdan May 9, 2023

Description

What did you expect to happen?

What happened instead?

Output of run with --debug:

Output of trivy -v:

Additional details (base image name, container registry info...):

Replies: 1 comment · 11 replies

knqyf263 May 10, 2023 Maintainer

FrimIdan May 22, 2023 Author

knqyf263 May 22, 2023 Maintainer

FrimIdan May 22, 2023 Author

knqyf263 May 22, 2023 Maintainer

FrimIdan May 22, 2023 Author

FrimIdan
May 9, 2023

Output of run with `--debug`:

Output of `trivy -v`:

Replies: 1 comment 11 replies

knqyf263
May 10, 2023
Maintainer

FrimIdan May 22, 2023
Author

knqyf263 May 22, 2023
Maintainer

FrimIdan May 22, 2023
Author

knqyf263 May 22, 2023
Maintainer

FrimIdan May 22, 2023
Author