PT-2020-15904 · Sylabs+1 · Sylabs Singularity+1
Published
2020-09-16
·
Updated
2024-06-15
·
CVE-2020-25040
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Sylabs Singularity versions 3.6.2 and earlier
Description
The issue concerns insecure permissions on temporary directories used in explicit and implicit container build operations. When a Singularity command that results in a container build operation is executed, it is possible for a user with access to the system to read the contents of the image during the build. Additionally, if the image contains a world-writable file or directory, it is possible for a user to inject arbitrary content into the running build, which in certain circumstances may enable arbitrary code execution during the build and/or when the built container is run.
Recommendations
For Sylabs Singularity versions 3.6.2 and earlier, upgrade to version 3.6.3 to address the issue.
As a temporary workaround, consider setting
TMPDIR to a location that is only accessible to the user, however, this is difficult to enforce and not recommended to rely on as a mitigation.Fix
Incorrect Permission
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Sylabs Singularity