Contrast is a confidential‑computing runtime for Kubernetes. In versions before 1.18.0, guest kernel ACPI/AML handling is vulnerable to an AML injection attack referred to as BadAML. ACPI tables containing AML bytecode are supplied by the untrusted host (QEMU) to the guest firmware (OVMF) and then to the Linux kernel, where the AML interpreter executes them. An attacker who controls the host can craft a malicious AML bytecode table that the guest kernel interprets with full access to guest memory, allowing arbitrary code execution and disclosure or modification of confidential data. The weakness is generic to confidential computing setups that expose the ACPI interface to the host.

The affected vendor is edgelesssys, product Contrast. All Contrast releases before version 1.18.0 are vulnerable. The issue specifically affects AMD SEV‑SNP platforms, namely Metal‑QEMU‑SNP and Metal‑QEMU‑SNP‑GPU. Metal‑QEMU‑TDX is not affected because the OVMF implementation for Intel TDX measures ACPI table contents into RTMR 0.

The CVSS score of 8.4 indicates a high severity of this vulnerability. The EPSS score is currently unavailable, but the lack of a CISA KEV listing does not decrease the realistic risk, especially in environments where the host is trusted. The likely attack vector requires an adversary controlling the host, which is assumed in Contrast’s threat model. If an attacker can manipulate ACPI tables, the vulnerability permits remote code execution on the guest, potentially compromising all confidential data stored or processed by the guest.