Apptainer, Security Bypass, GHSA-wwrx-w7c9-rf87 (critical)

Listen to this Post

🐢▶️ Listen🚀

In Apptainer versions before 1.4.5, a vulnerability exists where containers can bypass security enforcement mechanisms. The `–security` option, with forms `–security=apparmor:` and --security=selinux:<label>, is designed to restrict container operations using AppArmor or SELinux profiles. However, a flaw allows a malicious container to disable these security flags internally, neutralizing the imposed restrictions. This occurs because the container can manipulate the environment or execution flow to ignore the specified security profiles. Additionally, in setuid (suid) mode, a bug affects the detection of SELinux support. When `–security selinux:` is used, the system may incorrectly determine that SELinux is unavailable, leading to the security label not being applied. Instead of terminating with a fatal error, Apptainer only emits a warning message. This warning can be easily overlooked, especially in automated scripts or toolchains, resulting in silent failure of security enforcement. The issue stems from ineffective writing of SELinux process labels due to a dependency bug and ineffective writing of AppArmor process profiles. The vulnerability affects unprivileged users on systems where AppArmor (default on Debian-based distributions) or SELinux (default on RHEL-based distributions) is enabled. Although the `–security` option is documented for root users, these forms function for unprivileged users when the underlying security module is active. The bypass undermines container isolation and can lead to privilege escalation or unauthorized actions within the host context.
Platform: Apptainer
Version: versions < 1.4.5
Vulnerability: Security bypass
Severity: Critical
date: Not specified

Prediction: Patched in 1.4.5

What Undercode Say:

Analytics:

`apptainer –version`

`apptainer run –security=apparmor:profile container.sif`

`apptainer run –security=selinux:label container.sif`

`aa-status` or `ps -Z`

`grep -i security /var/log/syslog`

How Exploit:

Container disables –security flags.

Manipulates environment to bypass AppArmor/SELinux.

Exploits suid mode selinux detection bug.

Protection from this CVE

Update to Apptainer 1.4.5.

Apply system-wide AppArmor/SELinux policies.

Monitor for warning messages.

Impact:

Bypasses security restrictions.

Potential privilege escalation.

Reduced container isolation.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin