UBUNTU-CVE-2026-121876: High severity ubuntu/systemd vulnerability
A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the PodVM measurement script to capture PCR 5 (GPT partition table) so partition table modifications are detected by remote attestation.
Event History
Frequently Asked Questions
Which environments are realistically exposed?
The affected scenario is confidential computing guest VM images used for OpenShift Sandboxed Containers confidential peer pods. The confidentiality impact specifically concerns hardware TEE guests using AMD SEV-SNP or Intel TDX where the host or hypervisor is within the threat model.
What does an attacker need to exploit this?
An attacker controlling the host or hypervisor must be able to inject GPT partitions into the guest's virtual disk. A malicious swap partition is particularly severe because it can cause TEE-encrypted guest memory to be paged to a host-controlled block device.
Does dm-verity or the roothash kernel parameter prevent this issue?
No. The roothash= parameter disables automatic discovery only for the root partition; systemd-gpt-auto-generator can still discover and mount non-root partition types, including swap, /home, /var, /srv, and /var/tmp.
Would the described PodVM measurement detect a modified GPT partition table?
Not based on the listed measurements. The script records PCRs 3, 9, 11, and 12, but does not record PCR 5, which covers the GPT partition table.