oss-sec mailing list archives
Singularity's Linux kernel vulnerability claim
From: "Priedhorsky, Reid" <reidpr () lanl gov>
Date: Thu, 3 May 2018 17:12:06 +0000
Folks, Singularity is a container runtime targeting the high-performance computing market. It appears to be the sole product of Sylabs, Inc. [1] and has both “community” (open source) and “pro” (closed source) versions. Recently, the Singularity team announced on their blog [2], following up an earlier mailing list post [3], that they’ve found:
an exploit vector to all container runtimes, that allows a malicious user to gain additional privileges within a container on hosts running kernels that do not support the PR_SET_NO_NEW_PRIVS feature
No technical details are publically available:
Sylabs has not provided details about this exploit because there is no workaround short of upgrading the kernel or uninstalling Singularity. So giving more information will only help malicious parties.
We understand that details have been offered by Sylabs to at least one third party under NDA. This third party declined, but others may have accepted. Sylabs does not plan to request a CVE (link in original):
As of now, Sylabs will not request a CVE for this issue because it only affects old kernels and CVE’s associated with PR_SET_NO_NEW_PRIVS have already been provided and resolved [4].
My questions: 1. Does anyone know what is going on with this alleged vulnerability? 2. Has anything been independently corroborated? 3. Would a CVE request be appropriate? Thanks, Reid [1]: https://www.sylabs.io/ [2]: https://www.sylabs.io/2018/05/whatsnew-singularity-2-5-why-affects-everyone-using-containers/ [3]: https://groups.google.com/a/lbl.gov/forum/#!topic/singularity/2h8KYUblVxA [4]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3215
Current thread:
- Singularity's Linux kernel vulnerability claim Priedhorsky, Reid (May 03)
- Re: Singularity's Linux kernel vulnerability claim gremlin (May 03)