CVE-2020-25040

Vulnerability

Description

Sylabs Singularity through version 3.6.2 contains a vulnerability related to insecure permissions on temporary directories used during explicit and implicit container build operations [1][2]. This issue is distinct from CVE-2020-25039 [1].

Attack

Vector and Prerequisites

A local user with access to the system can exploit this by reading the contents of the container image while it is being built [2]. Furthermore, if the image itself contains a world-writable file or directory, an attacker can inject arbitrary content into the build process [2]. This injection can potentially lead to arbitrary code execution during the build or when the resulting container is run [2].

Impact

The impact includes unauthorized disclosure of sensitive image data and, in the presence of world-writable elements, arbitrary code execution with the privileges of the build process [2]. This could compromise the integrity of the built container and the host system.

Mitigation

Singularity 3.6.3 addresses this vulnerability [2]. Users are advised to upgrade immediately [2]. As a workaround, setting the TMPDIR environment variable to a directory accessible only by the user can mitigate the issue, but this is difficult to enforce and not recommended as a primary fix [2].