-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/sylabs/singularity/v4 | go | >= 4.2.0-rc.1, < 4.3.5 | 4.3.5 |
| github.com/sylabs/singularity/v4 | go | < 4.1.11 | 4.1.11 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from Singularity's insecure handling of AppArmor and SELinux profile application, which could allow a malicious container to bypass security restrictions. The analysis of the provided patches reveals three key functions involved in this process.
apparmor.LoadProfile: This function in internal/pkg/security/apparmor/apparmor_supported.go was found to be writing the AppArmor profile to /proc/self/attr/exec without proper validation of the file path. As shown in commit 5af3e79, this could be exploited by redirecting the write, thus neutralizing the security profile. The fix involves using the pathrs-lite/procfs library to ensure the integrity of the file operation.
selinux.SetExecLabel: This function, called from security.Configure, is responsible for applying SELinux labels. The vulnerability here was not in Singularity's code itself, but in a dependency, github.com/opencontainers/selinux. Commit 52b74e59f059e931434504fc5be03e017d4d52c1 addresses this by updating the dependency to a version that fixes an ineffective label write issue (CVE-2025-52881).
security.Configure: This function in internal/pkg/security/security.go acts as the orchestrator for applying these security settings. A significant flaw, fixed in commit 2788296, was that it would only issue a warning if a requested security module (AppArmor or SELinux) was unavailable, rather than halting execution. This could lead to a container running with a false sense of security. The function is a critical part of the vulnerability chain as it calls the other vulnerable functions and its logic allowed for silent failures.
In summary, the root cause is a combination of insecure file handling when applying security profiles and insufficiently strict error handling, allowing for silent failures. The identified functions are central to the exploitation of this vulnerability and would be expected to appear in a runtime profile during such an event.
apparmor.LoadProfileinternal/pkg/security/apparmor/apparmor_supported.go
security.Configureinternal/pkg/security/security.go
selinux.SetExecLabelinternal/pkg/security/security.go
Ongoing coverage of React2Shell