Description
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| uber | kraken | ≤ 0.1.27 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | kraken | No fix yet | — |
| Ubuntu 26.04 LTS | kraken | No fix yet | — |
| Ubuntu 24.04 LTS | kraken | No fix yet | — |
| Ubuntu 22.04 LTS | kraken | No fix yet | — |
| Ubuntu 20.04 LTS | kraken | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | kraken | No fix yet | — |
| Ubuntu 16.04 LTS | kraken | No fix yet | — |
References
- GitHub Issue #638 issue-tracking
- https://github.com/uber/kraken product
- writePiece/WritePiece in lib/torrent/storage/agentstorage/torrent.go technical-description
- VulnCheck Advisory: Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass third-party-advisory