CVE-2020-25039

Vulnerability

Description

CVE-2020-25039 is an insecure permissions vulnerability in Sylabs Singularity versions 3.2.0 through 3.6.2. When a container is executed using the fakeroot or user namespace option, the container image is extracted to a temporary sandbox directory. Due to improper permission settings on these temporary directories, other users on the same system can access and read the contents of the image [1].

Exploitation

Method

An attacker needs only local access to the system where a vulnerable Singularity action command (run, shell, exec) is executed with either the fakeroot or user namespace flag. The temporary directory is created with permissions that are too permissive, allowing any unprivileged user to traverse and read files from the extracted container image. Furthermore, if the container image itself contains a world-writable file or directory, a local attacker can inject arbitrary content into the running container [2].

Impact

Successful exploitation can lead to disclosure of sensitive data present inside the container image, such as configuration files, secrets, or application data. In the case of a world-writable entry in the image, an attacker may also modify files within the running container, potentially altering its behavior or compromising the execution environment [1][2].

Mitigation

Sylabs addressed this issue in Singularity 3.6.3. Users are strongly advised to upgrade to this version or later. As a partial workaround, setting the TMPDIR environment variable to a directory that is only accessible to the user can reduce exposure, but this mitigation is not reliably enforceable and is not recommended as a sole defense [2]. The vulnerability is publicly documented and has been assigned a CVSS v3 score of 7.1 (HIGH).