openSUSE Backports Trivy Update: Three Security Issues Patched in Container Scanner — Remediation Guide

---
title: Suspicious Trivy Execution from Unusual Parent Process
id: 8f4a2b1c-9e3d-4f5a-b6c7-1a2b3c4d5e6f
status: experimental
description: Detects Trivy vulnerability scanner being executed by unusual parent processes, potentially indicating malicious container image exploitation or pipeline compromise
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0353-1-trivy
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/01/31
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/trivy'
      - '/trivy.exe'
  suspicious_parents:
    ParentImage|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/perl'
      - '/php'
  condition: selection and suspicious_parents
falsepositives:
  - Legitimate wrapper scripts in CI/CD pipelines
  - Development environments with shell-based scanning workflows
level: high
---
title: Trivy Database Download from Non-Standard Source
id: 7e3f1c82-8d4b-4e67-bc12-2f5a8f901235
status: experimental
description: Detects Trivy attempting to download vulnerability databases from non-Aqua Security sources, potentially indicating supply-chain compromise or malicious database injection
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0353-1-trivy
author: Security Arsenal
date: 2026/01/31
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/trivy'
    DestinationHostname|contains:
      - 'github.com'
      - 'ghcr.io'
      - 'aquasecurity.github.io'
  filter:
    DestinationHostname|contains:
      - 'github.com/aquasecurity'
      - 'ghcr.io/aquasecurity'
  condition: selection and not filter
falsepositives:
  - Mirror or proxy configurations in air-gapped environments
  - Internal artifact repositories hosting Trivy DB
level: medium
---
title: Trivy Execution with Unusual Privileges
id: 6d2e0b71-7c3a-3d56-ab01-1e4b7f890124
status: experimental
description: Detects Trivy running with root privileges outside of expected CI/CD contexts, potentially indicating privilege escalation or exploitation attempt
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0353-1-trivy
author: Security Arsenal
date: 2026/01/31
tags:
  - attack.privilege_escalation
  - attack.t1078
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/trivy'
    User: 'root'
  filter:
    ParentImage|contains:
      - '/docker'
      - '/containerd'
      - '/jenkins'
      - '/gitlab-runner'
  condition: selection and not filter
falsepositives:
  - Manual administrative scanning
  - Legitimate privileged container scanning
level: medium

// Detect Trivy executions from unusual directories or with suspicious arguments
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName =~ "trivy"
| extend CommandLine = tostring(split(SyslogMessage, " ")[1..])
| extend CommandLineStr = strcat_array(CommandLine, " ")
| where CommandLineStr has_any ("--download-db-only", "--server", "--token", "--password")
   or SyslogMessage has_any ("/tmp/", "/dev/shm/", "/var/tmp/")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SourceIP
| order by TimeGenerated desc

// Detect Trivy making outbound connections to non-standard ports or IPs
// Requires CommonSecurityLog (CEF) ingestion from firewall or network sensors
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ApplicationProtocol =~ "trivy" or RequestURL has "trivy"
| where DestinationPort !in (443, 80)
   or DestinationIP !startswith "140.82."  // GitHub
   and DestinationIP !startswith "185.199."  // GitHub Pages
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, DeviceAction
| summarize ConnectionCount = count() by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| where ConnectionCount > 10

// Detect modification of Trivy binary (if using file integrity monitoring)
// Requires FIM data forwarded to Sentinel
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4663  // File access (if auditing Linux via Windows bridge) or use Syslog for Linux
| where ObjectName has "/trivy"
| where AccessMask has_any ("0x2", "0x4")  // Write or Append
| project TimeGenerated, Computer, SubjectUserName, ObjectName, ProcessName

-- Hunt for running Trivy processes and verify their integrity
SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    hash(path=Exe) as BinaryHash
FROM pslist()
WHERE Name =~ "trivy"
   OR Exe =~ "/trivy"

-- Locate Trivy binaries and check for recent modification
SELECT 
    FullPath,
    Size,
    Mtime,
    hash(path=FullPath) as SHA256
FROM glob(globs=[
    "/usr/bin/trivy",
    "/usr/local/bin/trivy", 
    "/opt/*/trivy",
    "/home/*/.local/bin/trivy"
])
WHERE Mtime > ago(7d)

#!/bin/bash
# Trivy Security Update Verification and Remediation
# openSUSE 2026-0353-1

echo "=== Trivy Security Patching Script ==="
echo "Target: openSUSE Leap 15.6 / SLES 15 SP6 Backports"
echo "Required Version: 0.67.2-bp156.2.3.1 or later"
echo ""

# Check if Trivy is installed
if ! command -v trivy &> /dev/null; then
    echo "[INFO] Trivy not found in PATH. Checking RPM database..."
    if rpm -q trivy &> /dev/null; then
        INSTALLED_VERSION=$(rpm -q trivy --qf '%{VERSION}-%{RELEASE}')
        echo "[WARN] Trivy installed but not in PATH. Version: $INSTALLED_VERSION"
    else
        echo "[INFO] Trivy is not installed via RPM. Check for manual installations."
        find /usr/local/bin /opt /home -name "trivy" -type f 2>/dev/null | while read -r binary; do
            echo "[FOUND] Manual installation: $binary"
            "$binary" version 2>/dev/null || echo "  Could not determine version"
        done
        exit 0
    fi
else
    INSTALLED_VERSION=$(trivy version 2>/dev/null | grep "Version:" | awk '{print $2}')
    echo "[INFO] Current Trivy version: $INSTALLED_VERSION"
fi

# Check if we're running a vulnerable version
if [[ "$INSTALLED_VERSION" == "0.67.2"* ]]; then
    echo "[PASS] Trivy appears to be version 0.67.2 or later"
    
    # Verify it's the openSUSE patched version
    if rpm -q trivy | grep -q "bp156.2.3.1"; then
        echo "[PASS] openSUSE security patch confirmed (bp156.2.3.1)"
    else
        echo "[WARN] Version 0.67.2 detected but not confirmed as openSUSE backport patch"
        echo "       Run 'zypper patch' to ensure official update is applied"
    fi
else
    echo "[FAIL] Vulnerable version detected: $INSTALLED_VERSION"
    echo "       Required: 0.67.2-bp156.2.3.1 or later"
    echo ""
    echo "[ACTION] Applying security update..."
    
    # Refresh repositories and apply the specific patch
    sudo zypper refresh
    sudo zypper patch --cve openSUSE-2026-0353
    
    # Alternative: Update trivy package directly
    # sudo zypper update trivy
    
    echo "[INFO] Update complete. Verify with: trivy version"
fi

# Verification of running processes
echo ""
echo "=== Running Trivy Processes ==="
if pgrep -x "trivy" > /dev/null; then
    echo "[WARN] Trivy processes currently running. Restart scanning jobs to load patched binary."
    ps aux | grep trivy | grep -v grep
else
    echo "[INFO] No active Trivy processes found."
fi

echo ""
echo "=== Remediation Complete ==="
echo "1. Verify version: trivy version"
echo "2. Re-scan critical images with updated database: trivy image --refresh <image>"
echo "3. Review CI/CD pipeline logs for scanning anomalies during unpatched window"