CVE-2025-64750
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sylabs | singularitypro | 4.3.5 |
| opencontainers | runc | * |
| sylabs | singularitypro | 4.1.11 |
| sylabs | singularityce | 4.3.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects SingularityCE and SingularityPRO container platforms before versions 4.3.5 and 4.1.11/4.3.5 respectively. It allows an attacker to bypass Linux Security Module (LSM) restrictions by redirecting the LSM label write operation. The attacker must trick a user into running a malicious container image that remounts /proc to a shared mount point controlled by the attacker, either via another malicious container or by having relevant permissions on the host. This redirection makes the LSM restrictions ineffective.
How can this vulnerability impact me? :
This vulnerability can lead to a partial bypass of security restrictions enforced by LSMs, potentially allowing an attacker to perform malicious operations that should have been blocked. This could result in unauthorized access, data manipulation, or other security breaches within the container environment, impacting the integrity, confidentiality, and availability of the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update SingularityCE to version 4.3.5 or later, and SingularityPRO to versions 4.1.11 or 4.3.5 or later. Avoid running untrusted or malicious container images, especially those that redirect the mount of /proc to shared mounts. Ensure that shared mounts are properly secured and that only trusted users have permissions to control their content.