Log in Start free

Vulnerability · Published Jul 25, 2023 · Assigned by GitHub_M

CVE-2023-38496Apptainer's ineffective privileges drop when requesting container network

Medium 6.1

In plain English

A medium-severity privilege mismanagement in apptainer from apptainer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/apptainer/apptainer1.2.1GHSA-mmx5-32m4-wxvx
Gogithub.com/apptainer/apptainer1.2.1GO-2023-1965

Affected products (as reported)

VendorProductVersions
apptainer apptainer >= 1.2.0-rc.2, < 1.2.1

Weakness: CWE-271, CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References