SUSE’s Response to the Trivy Toolchain Incident

UPDATE: Since posting, it’s been reported that more compromised Trivy images have been pushed to Dockerhub. SUSE does not pull images from Dockerhub. Further, on Friday SUSE pinned all of our toolchains to the hash of the last known good version of Trivy so we would not have been susceptible to such an attack.
___
SUSE’s engineering teams spent last Friday and the weekend responding to the Trivy Toolchain attack. We can confirm that neither SUSE nor any of SUSE’s products were impacted, to the best of our knowledge.

We provide Trivy in our SUSE Application Collection. The attack was on the Trivy toolchain but we build Trivy from source in an offline Open Build Service environment, so SUSE’s Trivy builds could not be impacted. We took down the impacted version tag before any customers could pull them to avoid any confusion. Products such as SUSE Security that rely on Trivy were also unimpacted.

Some of our Community Open Source repositories use upstream Trivy builds. The community RKE2 builds did pull and use the affected Trivy binary, but there was no way for this to be a threat. By design, if exfiltration occurred, the attack could only exfiltrate useless short-lived read-only tokens that anyone in the community could easily create for themselves anyway. Additionally, our code repositories require a formal PR review for any changes to ensure that if a bad actor does ever get write access, they can’t force any changes.

This is a reminder to stay humble and vigilant. Threat actors are better funded and more experienced than ever, and now they have powerful AI tools as well.

Going forward we will be further hardening our toolchain based on community learnings. For example, ensuring that repos are pinned to commit hashes rather than tags when we are using upstream components. Additionally, we are continuing an exhaustive SUSE-wide audit to rule out any possibility that the malicious binary was used anywhere and that no tokens were exfiltrated. 

Addendum: For our SUSE Linux based products we usually build from sources, which were not affected, and are also reviewed before acceptance. We also audited our services using trivy and did not find use of the affected packages.