No Socket, No Privs, No Problem - Weaponizing OCI Registries

The talk asks whether a routine container or model pull, which needs no special privileges, can be turned into an attack. The presenters briefly explain OCI registries: manifests describe blobs named by SHA-256 digest, and clients talk a JSON-over-HTTP distribution protocol. They focus on Ollama and Docker Model Runner because both give registry client access to users who do not have host access.

The middle covers the findings. A malicious registry can answer an authentication challenge with an arbitrary URL, so the client makes server-side requests to internal services or cloud metadata endpoints. Depending on the response, the client either forwards a token to the attacker or returns the full response to the caller, which makes a read-capable SSRF. In Ollama, exposed servers without authentication could be made to copy host files through crafted manifest paths, and because no hash verification happened, SSH keys, environment variables, and cloud credentials could be exfiltrated. On macOS, Docker Model Runner's inference libraries run as host processes, and a model definition file executed on load gave code execution outside the sandbox.

The closing section covers vendor responses. Some reports went unanswered for more than 90 days, some earned CVEs, and Apple judged one issue to be working as intended. The speakers said roughly 75,000 Ollama servers were still internet-exposed when they rechecked. The takeaway is that any tool using OCI in some form may offer similar primitives, so pulls from untrusted registries should be treated as untrusted input.