CVE-2023-38496 Apptainer's ineffective privileges drop when requesting container network
An attacker can craft a starter config to delete host directories due to ineffective privilege dropping during network setup in Apptainer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-38496?
CVE-2023-38496 is a medium-severity vulnerability in apptainer, published on 25 Jul 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.
Which versions are affected by CVE-2023-38496?
3 open source packages ship an affected version, including github.com/apptainer/apptainer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/apptainer/apptainer Go | From 1.2.0 | 1.2.1 |
github.com/apptainer/apptainer Go | From 1.2.0 | 1.2.1 |
github.com/apptainer/apptainer Go | From 1.2.0 | 1.2.1 |
Linux distribution packages (1)
apptainer openSUSE:Tumbleweed | All versions | 1.2.1-1.1 |
Products include Lfprojects Apptainer.
How do I fix CVE-2023-38496?
Upgrade github.com/apptainer/apptainer to 1.2.1 or later.
Is CVE-2023-38496 being exploited?
There is no known exploitation of CVE-2023-38496 in the wild and no public exploit code.
Other vulnerabilities in apptainer
Sources
Also known as GHSA-mmx5-32m4-wxvx, GO-2023-1965, openSUSE-SU-2024:13073-1.