Apptainer's ineffective privileges drop when requesting container network

Vulnerability

CVE-2023-38496 affects Apptainer, an open-source container platform, specifically version 1.2.0-rc.2. The vulnerability arises from an ineffective privilege drop when requesting container network setup. This flaw causes subsequent functions to be called with root privileges instead of the intended lower privileges [1].

Exploitation

The attack surface is limited, as exploitation requires crafting a starter configuration. An attacker who can provide such a configuration may trigger the privilege escalation during network setup, leveraging the ineffective drop to execute operations with elevated privileges [1].

Impact

If successfully exploited, an attacker could delete any directory on the host filesystem, posing a significant integrity and availability risk. However, the prerequisite of crafting a starter config reduces the practical attack surface [1].

Mitigation

A security fix has been included in Apptainer version 1.2.1. Users are advised to upgrade immediately, as there is no known workaround outside of this update [1]. The fix addresses the root cause by correcting the privilege drop mechanism (as seen in related pull requests [2][4]).