CVE-2025-65105
BaseFortify
Publication date: 2025-12-02
Last updated on: 2025-12-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lfprojects | apptainer | to 1.4.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apptainer versions less than 1.4.5 allows a container to disable two specific forms of the --security option (--security=apparmor:<profile> and --security=selinux:<label>). These options normally impose restrictions on container operations to enhance security. Because of this flaw, containers can bypass these security restrictions, potentially allowing more actions than intended. The --security option is primarily intended for root users but also works for unprivileged users if the corresponding security feature is enabled on the system.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing containers to disable important security restrictions that limit what operations they can perform. This could lead to containers performing unauthorized actions, potentially compromising the host system's security. Since Apparmor and SElinux are security modules that enforce mandatory access controls, bypassing them increases the risk of container breakout or unauthorized access to system resources.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Apptainer to version 1.4.5 or later, as this version contains the fix for the vulnerability that allows containers to disable certain --security options. Additionally, ensure that Apparmor or SElinux is properly enabled and configured on your system according to your distribution defaults to maintain container security restrictions.