PT-2021-4280 · Sylabs · Sylabs Singularity+1

Published 2021-06-15 · Updated 2021-06-22 · CVE-2021-33622

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sylabs Singularity versions 3.5.x through 3.6.x SingularityPRO versions prior to 3.5-8

Description The issue is related to an incorrect check of a function's return value in a software used for operating system-level virtualization, also known as containerization. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For Sylabs Singularity versions 3.5.x through 3.6.x, update to a version that includes a fix for the incorrect check of a function's return value. For SingularityPRO versions prior to 3.5-8, update to version 3.5-8 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and functions to minimize the risk of exploitation.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2021-04888

CVE-2021-33622

Affected Products

Singularitypro

Sylabs Singularity

References · 10

• https://bdu.fstec.ru/vul/2021-04888 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33622 · Security Note
• https://ubuntu.com/security/CVE-2021-33622 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33622 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-33622 · Security Note
• https://support.sylabs.io/support/solutions/articles/42000087130-3-5-8-security-release-cve-2021-33622- · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33622 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-33622 · Vendor Advisory
• https://t.me/cvenotify/16376 · Telegram Post
• https://medium.com/sylabs · Note