Time-of-check Time-of-use (TOCTOU) Race Condition Affecting github.com/crossplane/crossplane-runtime/v2/pkg/xpkg package, versions >=2.3.0 <2.3.3

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the CachedClient.Get flow in pkg/xpkg/client.go. An attacker controlling an OCI registry can serve one signed image to fetcher.Head and validator.Validate, then swap the tag to different content before fetcher.Fetch and package extraction, causing Crossplane to install an unsigned malicious package despite signature verification succeeding. This affects users who enable package signature verification in ImageConfig and install packages by tag from registries they do not control. The result is installation of attacker-chosen package content, which can break package integrity and let malicious package code or manifests run in the cluster.

Workarounds

• Install packages by image digest rather than by tag reference; this prevents a registry from swapping tag content between signature verification and package fetch/install.

• GitHub Commit v2.3.3
• Maintainer's Advisory