Medium, CVSS 4.5GoPublished
Singluarity ineffectively applies selinux / apparmor LSM process labels
CVE-2025-64750 · GHSA-wwrx-w7c9-rf87
- Affected
- Go github.com/sylabs/singularity/v4 >= 4.2.0-rc.1, < 4.3.5; < 4.1.11
- Fixed in
- 4.1.114.3.5· Vendor fix available
- Issue
- Impact Native Mode (default) Singularity's default native runtime allows users to apply restrictions to container processes using the apparmor or selinux Linux Security Modules (LSMs), via the --security selinux:<label or --security apparmor:<profile flags. LSM labels are written to process or thread attrs/exec under /proc. If a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. This requires: The attacker to cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. Control of the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. Note that Singularity does…
Recommended action: Upgrade to 4.3.5 or 4.1.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.