CVE-2020-13845

Vulnerability

Details

CVE-2020-13845 affects Sylabs Singularity versions 3.0 through 3.5. The Execution Control List (ECL) mechanism is designed to enforce policies on which signed container images may run. However, the integrity check is improperly implemented: the fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file rather than against a cryptographically validated signature. This means the ECL does not actually verify that the image has not been tampered with since signing [1][2].

Exploitation

An attacker who can supply a malicious SIF container image to a system with ECL enabled can trivially bypass the policy. Because the fingerprint comparison is performed against the descriptor (which can be arbitrarily set) rather than a cryptographic signature, the attacker does not need access to the private key associated with the configured fingerprint. Crafting a payload that passes the ECL check is straightforward [2].

Impact

Successful exploitation allows an attacker to run arbitrary container images that violate the ECL policy. This undermines the security guarantees that ECL was intended to provide, potentially leading to unauthorized code execution or privilege escalation within the container environment [1][2].

Mitigation

The issue is fixed in Singularity 3.6.0. Users are strongly advised to upgrade. Note that version 3.6.0 introduces a new signature format that is incompatible with earlier versions. A legacyinsecure = true option is available in ecl.toml to temporarily support older signatures, but this does not restore integrity validation and should only be used as a transitional measure. No workaround exists if ECL is required and the system cannot be upgraded [2].