Skip to content
OpenAdvisories
Medium · 6.1 CVE-2023-38496 EUVD-2023-2102GHSA-mmx5-32m4-wxvxGO-2023-1965

Apptainer's ineffective privileges drop when requesting container network

Published Jul 25, 2023 · Updated Oct 10, 2024 · Assigned by GitHub_M

Description

Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.

Affected products

VendorProductAffectedFixed
apptainer apptainer >= 1.2.0-rc.2, < 1.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP5 apptainer 1.3.0-bp155.3.3.2 openSUSE-SU-2024:0244-1
SUSE Package Hub 15 SP5 squashfuse 0.5.0-bp155.2.1 openSUSE-SU-2024:0244-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apptainer 1.2.1-1.1 openSUSE-SU-2024:13073-1
openSUSE Leap 15.5 apptainer 1.3.0-bp155.3.3.2 openSUSE-SU-2024:0244-1
openSUSE Leap 15.5 squashfuse 0.5.0-bp155.2.1 openSUSE-SU-2024:0244-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/apptainer/apptainer >= 1.2.0, < 1.2.1 1.2.1 GHSA-mmx5-32m4-wxvx

Advisories 2

References