Bug 2555374

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in RHEL image-mode (bootc) update handling when used with the default containers signature policy. Hosts enrolled to a mutable image tag can automatically fetch and apply updated content for that tag via bootc upgrade / bootc-fetch-apply-updates without signature verification for registries that fall through to insecureAcceptAnything. An attacker who can publish content to the enrolled mutable reference can cause the host to reboot into attacker-controlled OS content running as host root. bootc rollback does not revert persistent /var state written during the malicious deployment window, so naive rollback remediation may leave attacker persistence intact.