PT-2020-15903 · Sylabs+1 · Sylabs Singularity+1

Published 2020-09-16 · Updated 2024-06-15 · CVE-2020-25039

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sylabs Singularity versions 3.2.0 through 3.6.2

Description The issue concerns insecure permissions on temporary directories used in fakeroot or user namespace container execution. When a Singularity action command is run with the fakeroot or user namespace option, Singularity extracts a container image to a temporary sandbox directory. Due to insecure permissions, any user with access to the system can read the contents of the image. If the image contains a world-writable file or directory, a user can inject arbitrary content into the running container.

Recommendations For Sylabs Singularity versions 3.2.0 through 3.6.2, upgrade to version 3.6.3 to address the issue. As a temporary workaround, consider setting TMPDIR to a location that is only accessible to the user, although this is not recommended as a reliable mitigation.

Fix

Incorrect Permission

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-732

CWE-668

Related Identifiers

CVE-2020-25039

GHSA-W6V2-QCHM-GRJ7

OPENSUSE-SU-2020:1497-1

OPENSUSE-SU-2020:1529-1

OPENSUSE-SU-2020_1497-1

OPENSUSE-SU-2024:11384-1

Affected Products

Suse

Sylabs Singularity

References · 29

• https://nvd.nist.gov/vuln/detail/CVE-2020-25039 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00070.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25039 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00088.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1529-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25039 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:1497-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25039 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11384-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25039 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6v2-qchm-grj7 · Vendor Advisory
• https://github.com/hpcng/singularity/security/advisories/GHSA-w6v2-qchm-grj7 · Note
• https://suse.com/security/cve/CVE-2019-19724 · Note
• https://bugzilla.suse.com/1176707 · Note
• https://suse.com/security/cve/CVE-2020-13846 · Note