Listen to this Post
The vulnerability allows an attacker to bypass intended AppArmor or SELinux restrictions in Singularity’s native runtime. When a user runs a container with the `–security` flag, Singularity writes the LSM label to the process’s `attrs/exec` file under /proc. An attacker can craft a malicious container image that causes `/proc` to be mounted from a shared mount point they control. This redirects the label write operation to an ineffective location. Additionally, a bug in the setuid flow could cause `–security selinux:` flags to be silently ignored, emitting only a warning instead of an error, leading users to believe restrictions are active when they are not. These issues require the attacker to influence which container image is run and control the shared mount destination.
Platform: Singularity
Version: Prior to patches
Vulnerability: LSM Bypass
Severity: High
date: 2025
Prediction: Q3 2025
What Undercode Say:
`singularity run –security seccomp:default ~/container.sif`
`singularity run –security apparmor:my_profile ~/container.sif`
`cat /proc/self/attr/exec`
`mount –bind /proc /malicious/proc`
`singularity run –bind /malicious/proc:/proc ~/container.sif`
How Exploit:
1. Create malicious container image.
2. Configure shared mount point.
- Trick user into running image with `–security` flag.
4. LSM label write is redirected.
5. Container runs without intended restrictions.
Protection from this CVE
Apply upstream patches.
Update `containers/selinux` dependency.
Treat security warnings as errors.
Impact:
Bypass of container security.
Potential privilege escalation.
Misleading warning messages.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
