CVE-2019-11328 : Security Advisory and Response

A vulnerability has been found in Singularity versions 3.1.0 to 3.2.0-rc2, allowing a malicious user to potentially escalate privileges on the host system.

Understanding CVE-2019-11328

What is CVE-2019-11328?

An issue in Singularity versions 3.1.0 to 3.2.0-rc2 enables a user with local or network access to the host system to exploit insecure permissions, leading to potential privilege escalation.

The Impact of CVE-2019-11328

The vulnerability could be exploited by a malicious user with access to the host system, allowing them to modify specific files and potentially escalate privileges.

Technical Details of CVE-2019-11328

Vulnerability Description

The vulnerability arises from insecure permissions that enable a user to modify files in a specific directory, potentially altering the behavior of a program and leading to privilege escalation.

Affected Systems and Versions

Singularity versions 3.1.0 to 3.2.0-rc2

Exploitation Mechanism

Malicious users can manipulate files in

/run/singularity/instances/sing/<user>/<instance>

to change the behavior of the starter-suid program, potentially escalating privileges on the host.

Mitigation and Prevention

Immediate Steps to Take

Upgrade to Singularity version 3.2.0 or later to mitigate the vulnerability.
Restrict network and local access to the host system to trusted users only.

Long-Term Security Practices

Regularly monitor and audit file permissions and access controls on the host system.
Implement the principle of least privilege to limit user capabilities and access.

Patching and Updates

Stay informed about security advisories and promptly apply patches and updates to the Singularity software.