Ineffective privileges drop when requesting container network

THẤP 3.3CVE-2023-38496 · GHSA-mmx5-32m4-wxvx · GO-2023-1965 · Công bố 25/07/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-38496 là lỗ hổng mức THẤP (CVSS 3.3) ảnh hưởng github.com/apptainer/apptainer, apptainer (lfprojects).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.26%, cao hơn 17.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.2.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/apptainer/apptainer Go	`≥ 1.2.0, < 1.2.1`	`1.2.1`
apptainer lfprojects	`= 1.2.0`	Chưa có bản vá

Mô tả

Impact

Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer 1.2.0-rc.2 has introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges. The attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. Only affects setuid installations of Apptainer.

Patches

The security fix https://github.com/apptainer/apptainer/pull/1578 has been included in Apptainer 1.2.1

Workarounds

There is no known workaround outside of upgrading to Apptainer 1.2.1

Mô tả của NVD

Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.