PT-2020-14295 · Sylabs+1 · Singularity+1
Published
2020-10-14
·
Updated
2024-06-15
·
CVE-2020-15229
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Singularity versions 3.1.1 through 3.6.3
Description
The issue arises from insecure handling of path traversal and the lack of path sanitization within
unsquashfs, allowing an attacker to overwrite or create any files on the host filesystem during the extraction of a crafted squashfs filesystem. This occurs automatically for unprivileged execution of Singularity when a user attempts to run an image from remote sources library:// or shub://, or a local SIF image. Image build is also impacted, potentially leading to system compromise, especially when performed by a root user. Bootstrap methods library, shub, and localimage trigger squashfs extraction.Recommendations
To resolve the issue, upgrade to Singularity 3.6.4, especially if Singularity is mainly used for building images as a root user.
As a temporary workaround, avoid using unprivileged mode with single file images and instead use sandbox images.
For image build, temporarily avoid building from
library and shub sources and use --fakeroot or a VM to limit potential impact.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Singularity
Suse