-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability in Apptainer (GHSA-j3rw-fx6g-q46j) consists of three related issues that lead to ineffective enforcement of security policies specified via --security options.
AppArmor Profile Bypass: The function apparmor.LoadProfile in internal/pkg/security/apparmor/apparmor_supported.go was responsible for applying an AppArmor profile. It did so by writing to /proc/self/attr/exec. However, it didn't validate that this path was a legitimate file inside the proc filesystem. This created a vulnerability where an attacker could use a symbolic link or other methods to redirect the write operation, causing the AppArmor profile to not be applied, without any error being raised. The patch in commit 4313b42 fixes this by using the pathrs-lite/procfs library to ensure the write happens to a genuine procfs file descriptor.
SELinux Label Ineffectiveness: The application of SELinux labels was flawed due to a vulnerability in a dependency, github.com/opencontainers/selinux. The function selinux.SetExecLabel in Apptainer calls this library. The underlying issue, related to GHSA-cgrx-mc8f-2prm, could cause the SELinux label to not be applied correctly. Commit 5049f6c addresses this by updating the dependency to a patched version (v1.13.1).
Failure to Error on Unavailable Security Mechanisms: The security.Configure function in internal/pkg/security/security.go orchestrates the application of these security settings. Prior to the patch, if a user requested an AppArmor or SELinux security profile, but the corresponding security module was not available on the system, Apptainer would only print a warning and proceed to run the container without the requested security restrictions. This "fail-open" behavior is dangerous, as the warning could be easily missed, leading to a false sense of security. The patch in commit 82f1790 changes this behavior to return a fatal error, thus ensuring the container does not run if the specified security settings cannot be enforced.
In summary, exploitation would involve the security.Configure function, which in turn calls apparmor.LoadProfile or selinux.SetExecLabel. These functions would appear in a runtime profile when the vulnerability is triggered.
apparmor.LoadProfileinternal/pkg/security/apparmor/apparmor_supported.go
security.Configureinternal/pkg/security/security.go
selinux.SetExecLabelinternal/pkg/security/selinux/selinux_linux.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/apptainer/apptainer | go | < 1.4.5 | 1.4.5 |
Ongoing coverage of React2Shell