CVE-2023-38496: Apptainer's ineffective privileges drop when requesting container network
First published: Tue Jul 25 2023(Updated: )
### Impact Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer 1.2.0-rc.2 has introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges. The attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. Only affects setuid installations of Apptainer. ### Patches The security fix https://github.com/apptainer/apptainer/pull/1578 has been included in Apptainer 1.2.1 ### Workarounds There is no known workaround outside of upgrading to Apptainer 1.2.1
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lfprojects Apptainer | =1.2.0-rc2 | |
| Lfprojects Apptainer | =1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-38496?
CVE-2023-38496 is a vulnerability in Apptainer, an open source container platform, that allows subsequent functions to be called with root privileges.
What is the impact of CVE-2023-38496?
The impact of CVE-2023-38496 is that subsequent functions are called with root privileges, potentially exposing the system to unauthorized access or privilege escalation.
Which versions of Apptainer are affected by CVE-2023-38496?
Apptainer versions 1.2.0-rc.2 and 1.2.0 are affected by CVE-2023-38496.
How can I fix CVE-2023-38496?
To fix CVE-2023-38496, update Apptainer to version 1.2.1 or higher.
Where can I find more information about CVE-2023-38496?
You can find more information about CVE-2023-38496 at the following references: [GitHub Advisory](https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-wxvx), [GitHub Pull Request](https://github.com/apptainer/apptainer/pull/1578), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-38496).
- collector/github-advisory-latest
- alias/GHSA-mmx5-32m4-wxvx
- alias/CVE-2023-38496
- collector/nvd-api
- collector/github-advisory
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/remedy
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- package-manager/go
- vendor/lfprojects
- canonical/lfprojects apptainer
- version/lfprojects apptainer/1.2.0
- version/lfprojects apptainer/1.2.0-rc2