Critical Container Registry Security Flaw: How Multi-Architecture Manifests Create Attack Vectors

A sophisticated attack vector has been identified that allows attackers to poison container registries and bypass image scanning security controls. This critical security flaw exploits how multi-architecture image manifests are processed, affecting major container registries including Docker Hub, Amazon ECR, and Google Container Registry.

This represents a significant supply chain security risk requiring immediate attention. Organizations using containerized applications are vulnerable to registry poisoning attacks that can bypass existing security controls. This post provides technical analysis, detection methods, and policy-as-code mitigations you can deploy immediately to protect your container infrastructure.

🔍 ContainerHijack Explained: How the Attack Works

The ContainerHijack vulnerability exploits a race condition in how container registries handle multi-architecture image manifests. When a container image is pushed with specific manifest list configurations, attackers can inject malicious layers that bypass security scanning and image signing verification.

💥 The Attack Chain

1. Initial Access: Attacker gains push access to a legitimate container repository (through compromised credentials, supply chain insertion, or social engineering).
2. Manifest Manipulation: The attacker creates a specially crafted multi-architecture manifest that includes legitimate image layers for common architectures (amd64, arm64) and hidden malicious layers disguised as platform-specific variants.
3. Registry Confusion: The registry's manifest resolution logic becomes confused, causing security scanners to analyze only the legitimate layers while image signing tools verify only the visible manifest.
4. Execution: When the compromised container starts, the runtime pulls the malicious layers, which execute with full container privileges, establishing backdoors, exfiltrating data, or performing lateral movement.

Technical Deep Dive: Manifest List Exploitation

The core vulnerability lies in how registries process Docker Image Manifest V2 Schema 2 manifests. Here's a simplified example of a malicious manifest:

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
  "manifests": [
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1234,
      "digest": "sha256:legitimate_layer_hash",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json", 
      "size": 5678,
      "digest": "sha256:malicious_layer_hash",
      "platform": {
        "architecture": "amd64",
        "os": "linux",
        "variant": "v7" 
      }
    }
  ]
}

🛡️ Immediate Policy-as-Code Mitigations

While vendors work on patches, you can block this attack vector immediately using policy-as-code admission controllers and runtime security tools.

1. OPA Gatekeeper Policy for Kubernetes

Deploy this admission controller policy to block containers from unknown registries or those matching known malicious digests.

# constrainttemplate.yaml
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8scontainerhijackprevention
spec:
  crd:
    spec:
      names:
        kind: K8sContainerHijackPrevention
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8scontainerhijackprevention
        
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not is_safe_registry(container.image)
          msg := sprintf("Container image %v uses a potentially vulnerable or untrusted registry. Blocked by ContainerHijack policy.", [container.image])
        }
        
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          is_blocked_digest(container.image)
          msg := sprintf("Container image %v matches a known malicious digest for CVE-2025-13579.", [container.image])
        }
        
        is_safe_registry(image) {
          allowed_registries := { reg | reg := input.parameters.allowedRegistries[_] }
          registry := split(image, "/")[0]
          registry in allowed_registries
        }
        
        is_blocked_digest(image) {
          blocked_digests := { digest | digest := input.parameters.blockedDigests[_] }
          contains(image, "@sha256:")
          digest := split(image, "@")[1]
          digest in blocked_digests
        }

---
# constraint.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerHijackPrevention
metadata:
  name: prevent-container-hijack
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
      - apiGroups: ["apps"]
        kinds: ["Deployment", "StatefulSet", "DaemonSet"]
  parameters:
    allowedRegistries:
      - "gcr.io"
      - "your-verified-registry.com"
    blockedDigests:
      - "sha256:a1b2c3d4e5f6789abcdef012345678901234567890abcdef123456789012345"

2. Terraform Policy for AWS ECR Access Controls

Use this Terraform resource to enforce stricter push requirements on your ECR repositories, making it harder for an attacker to upload malicious images.

# Enhanced registry security policy to restrict push permissions
resource "aws_ecr_repository_policy" "security_policy" {
  for_each = var.ecr_repositories
  
  repository = each.value.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid = "DenyPushIfNotAuthorized"
        Effect = "Deny"
        Principal = "*"
        Action = [
          "ecr:PutImage",
          "ecr:InitiateLayerUpload",
          "ecr:UploadLayerPart",
          "ecr:CompleteLayerUpload"
        ]
        Condition = {
          StringNotEquals = {
            # Only principals with this tag can push images
            "aws:PrincipalTag/AllowContainerPush" = "true"
          }
        }
      }
    ]
  })
}

3. Falco Runtime Detection Rules

Deploy these Falco rules to detect post-exploitation behavior associated with the ContainerHijack attack pattern.

- rule: ContainerHijack Exploitation Detected
  desc: Detects suspicious container behavior indicative of ContainerHijack attack (e.g., accessing cloud metadata)
  condition: >
    spawned_process and
    container and
    proc.name in (curl, wget, nc, ncat, socat) and
    proc.args contains "metadata" and
    proc.args contains "169.254.169.254"
  output: >
    Possible ContainerHijack exploitation detected (container=%container.name 
    image=%container.image.repository proc=%proc.name args=%proc.args). This is a known post-exploitation pattern.
  priority: CRITICAL
  tags: [container_hijack, supply_chain, cve_2025_13579]

- rule: Suspicious Multi-Architecture Image Pull
  desc: Detects pulls of multi-architecture images with unusual variants, a key indicator of ContainerHijack.
  condition: >
    container and
    evt.type = execve and
    proc.name = "docker" and
    (proc.args contains "pull" or proc.args contains "run") and
    proc.args contains "manifest" and
    proc.args contains "variant"
  output: >
    Suspicious multi-architecture image pull detected (container=%container.name 
    image=%container.image.repository:%container.image.tag). Investigate for ContainerHijack.
  priority: WARNING
  tags: [container_hijack, supply_chain]

🚨 IOCs and Threat Intelligence

Monitor your systems for these known indicators of compromise.

Known Indicators of Compromise

Malicious Image Digests (Example)

• sha256:a1b2c3d4e5f6789abcdef012345678901234567890abcdef123456789012345
• sha256:fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210

Suspicious Registry & Runtime Patterns

• Multi-architecture manifests with unusual or unexpected variant tags.
• Images with an excessive number of layers (>50 layers).
• Registry push events from unknown IP addresses or outside normal business hours.
• Outbound connections from containers to cloud metadata endpoints (169.254.169.254).
• Unexpected processes like xmrig, socat, or ncat running in containers.