Different results on Windows and macOS/Linux while scanning OCI images
What happened:
We run OCI image scans on different systems/os and observed a significant difference in the findings between Windows and Linux/macOS.
What you expected to happen:
We expect that the results of the scans are identical despite of the underlaying os.
How to reproduce it (as minimally and precisely as possible):
Scan on macOS of a Bitnami legacy image (mariadb:11.8.3-debian-12-r0) results in this report (shortened):
grype --sort-by epss docker:bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Loaded image bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Parsed image sha256:e0ad4c39fc9c5fd8ff03c48f91f24d96b9f1bd1f52310733c938c1975f899843
✔ Cataloged contents e0efcfa7a900366499ee60fdc64fc37d8f08c8ea1676791c417021ce67d8f270
├── ✔ Packages [113 packages]
├── ✔ Executables [860 executables]
├── ✔ File metadata [5,547 locations]
└── ✔ File digests [5,547 files]
✔ Scanned for vulnerabilities [134 vulnerability matches]
├── by severity: 2 critical, 23 high, 39 medium, 12 low, 55 negligible (3 unknown)
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
login 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
passwd 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
libgnutls30 3.7.9-2+deb12u5 deb CVE-2011-3389 Negligible 4.1% (88th) 0.2
tar 1.34+dfsg-1.2+deb12u1 deb CVE-2005-2541 Negligible 1.8% (82nd) < 0.1
libc-bin 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
apt 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libapt-pkg6.0 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libperl5.36 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
perl 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
perl-base 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9In contrast, on Windows we get this report (shortened):
grype --sort-by epss docker:bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Loaded image bitnamilegacy/mariadb:11.8.3-debian-12-r0@sha256:1b9e6738404c9c1a1d5c54167ff2fce02b90e6fc260dd8a9b3cd355549cfe60f
✔ Parsed image sha256:e0ad4c39fc9c5fd8ff03c48f91f24d96b9f1bd1f52310733c938c1975f899843
✔ Cataloged contents 4f925e705f75bf2b1d944127e75f2d86776850fb8256082e9d3c8e5691ca7733
├── ✔ Packages [120 packages]
├── ✔ File metadata [405 locations]
├── ✔ Executables [860 executables]
└── ✔ File digests [405 files]
✔ Scanned for vulnerabilities [141 vulnerability matches]
├── by severity: 2 critical, 24 high, 40 medium, 13 low, 59 negligible (3 unknown)
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
util-linux 2.38.1 2.39.4, 2.40.1 binary CVE-2024-28085 Low 11.9% (93rd) 3.8
login 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
passwd 1:4.13+dfsg1-1+deb12u1 (won't fix) deb CVE-2024-56433 Low 5.1% (89th) 1.7
libgnutls30 3.7.9-2+deb12u5 deb CVE-2011-3389 Negligible 4.1% (88th) 0.2
tar 1.34+dfsg-1.2+deb12u1 deb CVE-2005-2541 Negligible 1.8% (82nd) < 0.1
libc-bin 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
apt 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libapt-pkg6.0 2.6.1 deb CVE-2011-3374 Negligible 1.5% (80th) < 0.1
libperl5.36 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9
perl 5.36.0-7+deb12u2 5.36.0-7+deb12u3 deb CVE-2023-31484 High 1.2% (78th) 0.9So we have a difference of 134 vulnerability matches on macOS (with 2 critical, 23 high, 39 medium, 12 low, 55 negligible (3 unknown)) vs. 141 vulnerability matches on Windows (with 2 critical, 24 high, 40 medium, 13 low, 59 negligible (3 unknown)).
As you can see, the Windows version reports util-linux which is not reported by the macOS version.
And please take a note on the difference of the Cataloged contents:
| Content | macOS | Windows |
|---|---|---|
| Packages | 113 | 120 |
| Executables | 860 | 860 |
| File metadata | 5,547 | 405 |
| File digests | 5,547 | 405 |
Anything else we need to know?:
Tested this in a Linux VM on a AMD system, too, which gives same results as macOS.
If needed, I can provide a JSON or a debug output.
Environment:
- Output of
grype version:- macOS: grype 0.105.0
- Windows: grype 0.105.0
- OS:
- macOS 15.7.3 (ARM)
- Windows: Windows 11 Pro (10.0.26100)
- Vuln Database: On both systems
https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.3_2026-01-19T00:30:15Z_1768803534.tar.zst?checksum=sha256%3A9ef6ea8862fb4ab502bbc5cb5a1de505ec673ece93002b2d0b8748aeef6ae60e
As the macOS runs on Apple Silicon (ARM), I used the digest to ensure the correct platform image. On macOS, Rancher Desktop was used as the container engine, with VZ emulation and enabled Rosetta.
Source: anchore/syft