CVE-2021-32635 Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Attackers can execute malicious containers by exploiting incorrect remote endpoint resolution in Singularity action commands, requiring non-default remote configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32635?
CVE-2021-32635 is a medium-severity vulnerability in sylabs singularity, published on 28 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container. Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint. The vulnerability is patched in Singularity version 3.7.4. Two possible workarounds exist: Users can only interact with the default remote endpoint, or an installation can have an execution control list configured to restrict execution to containers signed with specific secure keys.
Which versions are affected by CVE-2021-32635?
2 open source packages ship an affected version, including github.com/sylabs/singularity. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sylabs/singularity Go | From 3.7.2 | 3.7.4 |
github.com/sylabs/singularity Go | From 3.7.2 | 3.7.4 |
Products include Sylabs Singularity.
How do I fix CVE-2021-32635?
Upgrade github.com/sylabs/singularity to 3.7.4 or later.
Is CVE-2021-32635 being exploited?
There is no known exploitation of CVE-2021-32635 in the wild and no public exploit code.
Other vulnerabilities in sylabs singularity
Sources
Also known as GHSA-5mv9-q7fq-9394, UBUNTU-CVE-2021-32635.