Trivyでコンテナイメージの脆弱性を診断する。

# はじめに
Trivyを使用して、KubernetesのAPIサーバなどのコンテナイメージの脆弱性を診断します。

https://github.com/aquasecurity/trivy

# 使用方法
[こちらから](https://github.com/aquasecurity/trivy/releases)バイナリをダウンロードしたり、yumなどでインストールすることで、`trivy`コマンドが利用できるようになります。
今回は[こちら](https://aquasecurity.github.io/trivy/v0.25.4/getting-started/installation/#docker)を参考にdockerでやってみます。

# 脆弱性診断

今回使用するKubernetesはv1.23.3です。
```
$ kubectl get node
NAME       STATUS   ROLES                  AGE   VERSION
master03   Ready    control-plane,master   16d   v1.23.3
worker03   Ready    <none>                 16d   v1.23.3
```

## APIサーバ
APIサーバのイメージを確認します。
```
$ kubectl -n kube-system get pod kube-apiserver-master03 -o yaml |grep image
    image: k8s.gcr.io/kube-apiserver:v1.23.5
    imagePullPolicy: IfNotPresent
    image: k8s.gcr.io/kube-apiserver:v1.23.5
    imageID: docker-pullable://k8s.gcr.io/kube-apiserver@sha256:ddf5bf7196eb534271f9e5d403f4da19838d5610bb5ca191001bde5f32b5492e
```

確認したイメージを指定して、診断します。
```
$ sudo docker run ghcr.io/aquasecurity/trivy:latest image k8s.gcr.io/kube-apiserver:v1.23.5
2022-04-14T13:36:17.993Z        INFO    Need to update DB
2022-04-14T13:36:17.993Z        INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-04-14T13:36:17.993Z        INFO    Downloading DB...
24.22 MiB / 31.19 MiB [----------------------------------------------->_____________] 77.66% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 11.60 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 11.60 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 11.60 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [-------------------------------------------------] 100.00% 26.84 MiB p/s 1.4s2022-04-14T13:36:21.446Z   INFO    Detected OS: debian
2022-04-14T13:36:21.446Z        INFO    Detecting Debian vulnerabilities...
2022-04-14T13:36:21.446Z        INFO    Number of language-specific files: 2

k8s.gcr.io/kube-apiserver:v1.23.5 (debian 11.2)
===============================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
```
脆弱性はありませんでした。

古いバージョン（v1.18.0）を指定すると、以下のように脆弱性が検出されました。

```
$ sudo docker run ghcr.io/aquasecurity/trivy:latest image k8s.gcr.io/kube-apiserver:v1.18.0
2022-04-14T13:38:17.430Z        INFO    Need to update DB
2022-04-14T13:38:17.431Z        INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-04-14T13:38:17.431Z        INFO    Downloading DB...
23.22 MiB / 31.19 MiB [--------------------------------------------->_______________] 74.45% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 13.27 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 13.27 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 13.27 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [-------------------------------------------------] 100.00% 27.16 MiB p/s 1.3s2022-04-14T13:38:21.074Z   INFO    Detected OS: debian
2022-04-14T13:38:21.074Z        INFO    Detecting Debian vulnerabilities...
2022-04-14T13:38:21.080Z        INFO    Number of language-specific files: 1

k8s.gcr.io/kube-apiserver:v1.18.0 (debian 10.1)
===============================================
Total: 137 (UNKNOWN: 0, LOW: 63, MEDIUM: 23, HIGH: 39, CRITICAL: 12)

+---------------+------------------+----------+-------------------+-------------------------+-----------------------------------------+
|    LIBRARY    | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |      FIXED VERSION      |                  TITLE                  |
+---------------+------------------+----------+-------------------+-------------------------+-----------------------------------------+
| apt           | CVE-2020-27350   | MEDIUM   | 1.8.2             | 1.8.2.2                 | apt: integer overflows and underflows   |
|               |                  |          |                   |                         | while parsing .deb packages             |
|               |                  |          |                   |                         | -->avd.aquasec.com/nvd/cve-2020-27350   |
+               +------------------+          +                   +-------------------------+-----------------------------------------+
---- 省略 ----
```

## etcd

同様にイメージを確認して、診断します。
```
$ sudo docker run ghcr.io/aquasecurity/trivy:latest image k8s.gcr.io/etcd:3.5.1-0
2022-04-14T13:40:29.936Z        INFO    Need to update DB
2022-04-14T13:40:29.936Z        INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-04-14T13:40:29.936Z        INFO    Downloading DB...
25.50 MiB / 31.19 MiB [------------------------------------------------->___________] 81.77% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 9.47 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 9.47 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 9.47 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [-------------------------------------------------] 100.00% 27.17 MiB p/s 1.3s2022-04-14T13:40:36.264Z   INFO    Detected OS: debian
2022-04-14T13:40:36.264Z        INFO    Detecting Debian vulnerabilities...
2022-04-14T13:40:36.264Z        INFO    Number of language-specific files: 6
2022-04-14T13:40:36.264Z        INFO    Detecting gobinary vulnerabilities...

k8s.gcr.io/etcd:3.5.1-0 (debian 11.1)
=====================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


usr/local/bin/etcd (gobinary)
=============================
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
|      LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| golang.org/x/text | CVE-2021-38561   | UNKNOWN  | v0.3.5            | 0.3.7         | Due to improper index calculation,    |
|                   |                  |          |                   |               | an incorrectly formatted              |
|                   |                  |          |                   |               | language tag can cause...             |
|                   |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-38561 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+

usr/local/bin/etcd-3.5.1 (gobinary)
===================================
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
|      LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| golang.org/x/text | CVE-2021-38561   | UNKNOWN  | v0.3.5            | 0.3.7         | Due to improper index calculation,    |
|                   |                  |          |                   |               | an incorrectly formatted              |
|                   |                  |          |                   |               | language tag can cause...             |
|                   |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-38561 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+

usr/local/bin/etcdctl (gobinary)
================================
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
|      LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| golang.org/x/text | CVE-2021-38561   | UNKNOWN  | v0.3.5            | 0.3.7         | Due to improper index calculation,    |
|                   |                  |          |                   |               | an incorrectly formatted              |
|                   |                  |          |                   |               | language tag can cause...             |
|                   |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-38561 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+

usr/local/bin/etcdctl-3.5.1 (gobinary)
======================================
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
|      LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| golang.org/x/text | CVE-2021-38561   | UNKNOWN  | v0.3.5            | 0.3.7         | Due to improper index calculation,    |
|                   |                  |          |                   |               | an incorrectly formatted              |
|                   |                  |          |                   |               | language tag can cause...             |
|                   |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-38561 |
+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+
```
コンテナイメージには脆弱性は検出されませんでしたが、gobinaryに一つ不明のものがあるようです。
ここでは、詳細までは確認していません。

## Controller-manager

```
$ sudo docker run ghcr.io/aquasecurity/trivy:latest image k8s.gcr.io/kube-controller-manager:v1.23.5
2022-04-14T13:47:41.688Z        INFO    Need to update DB
2022-04-14T13:47:41.688Z        INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-04-14T13:47:41.688Z        INFO    Downloading DB...
28.81 MiB / 31.19 MiB [-------------------------------------------------------->____] 92.39% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 3.96 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 3.96 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 3.96 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [-------------------------------------------------] 100.00% 28.27 MiB p/s 1.3s2022-04-14T13:47:45.076Z   INFO    Detected OS: debian
2022-04-14T13:47:45.076Z        INFO    Detecting Debian vulnerabilities...
2022-04-14T13:47:45.076Z        INFO    Number of language-specific files: 2

k8s.gcr.io/kube-controller-manager:v1.23.5 (debian 11.2)
========================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
```

脆弱性は検出されませんでした。

## Proxy server

```
$ sudo docker run ghcr.io/aquasecurity/trivy:latest image k8s.gcr.io/kube-proxy:v1.23.5
2022-04-14T13:48:27.800Z        INFO    Need to update DB
2022-04-14T13:48:27.800Z        INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-04-14T13:48:27.800Z        INFO    Downloading DB...
24.53 MiB / 31.19 MiB [----------------------------------------------->_____________] 78.66% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 11.09 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 11.09 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [---------------------------------------------->] 100.00% 11.09 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [-------------------------------------------------] 100.00% 27.64 MiB p/s 1.3s2022-04-14T13:48:31.060Z   INFO    Detected OS: debian
2022-04-14T13:48:31.060Z        INFO    Detecting Debian vulnerabilities...
2022-04-14T13:48:31.069Z        INFO    Number of language-specific files: 2

k8s.gcr.io/kube-proxy:v1.23.5 (debian 11.0)
===========================================
Total: 86 (UNKNOWN: 0, LOW: 58, MEDIUM: 10, HIGH: 11, CRITICAL: 7)

+------------------+------------------+----------+-------------------+-------------------------+-----------------------------------------+
|     LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |      FIXED VERSION      |                  TITLE                  |
+------------------+------------------+----------+-------------------+-------------------------+-----------------------------------------+
| apt              | CVE-2011-3374    | LOW      | 2.2.4             |                         | It was found that apt-key in apt,       |
|                  |                  |          |                   |                         | all versions, do not correctly...       |
|                  |                  |          |                   |                         | -->avd.aquasec.com/nvd/cve-2011-3374    |
+------------------+------------------+----------+-------------------+-------------------------+-----------------------------------------+
---- 省略 ----
```
たくさん出てきましたね。。

## Scheduler
```
$ sudo docker run ghcr.io/aquasecurity/trivy:latest image k8s.gcr.io/kube-scheduler:v1.23.5
2022-04-14T13:49:30.611Z        INFO    Need to update DB
2022-04-14T13:49:30.611Z        INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-04-14T13:49:30.611Z        INFO    Downloading DB...
27.09 MiB / 31.19 MiB [---------------------------------------------------->________] 86.88% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------------------->] 100.00% ? p/s ?31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 6.81 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 6.81 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [----------------------------------------------->] 100.00% 6.81 MiB p/s ETA 0s31.19 MiB / 31.19 MiB [-------------------------------------------------] 100.00% 27.31 MiB p/s 1.3s2022-04-14T13:49:33.326Z   INFO    Detected OS: debian
2022-04-14T13:49:33.326Z        INFO    Detecting Debian vulnerabilities...
2022-04-14T13:49:33.326Z        INFO    Number of language-specific files: 2

k8s.gcr.io/kube-scheduler:v1.23.5 (debian 11.2)
===============================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
```
脆弱性は検出されませんでした。

# まとめ
検出された脆弱性に対する対応までは確認していませんが、Trivyを使用することで簡単にコンテナイメージの脆弱性診断ができました。
今回はdockerでやってみましたが、頻繁に使う場合には、インストールやバイナリをダウンロードして、trivyコマンドを使えるようにした方がよいかなと思いました。