Ineffective privileges drop when requesting container network

低 3.3CVE-2023-38496 · GHSA-mmx5-32m4-wxvx · GO-2023-1965 · 25/07/2023 公開 · 17/06/2026 更新

要点

CVE-2023-38496 は github.com/apptainer/apptainer, apptainer (lfprojects) に影響する深刻度「低」 (CVSS 3.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.26%（全脆弱性の 17.8% より高い）。
対処：1.2.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/apptainer/apptainer Go	`≥ 1.2.0, < 1.2.1`	`1.2.1`
apptainer lfprojects	`= 1.2.0`	修正版なし

概要

Impact

Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer 1.2.0-rc.2 has introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges. The attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. Only affects setuid installations of Apptainer.

Patches

The security fix https://github.com/apptainer/apptainer/pull/1578 has been included in Apptainer 1.2.1

Workarounds

There is no known workaround outside of upgrading to Apptainer 1.2.1

NVD の説明

Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.