CVE-2023-38496
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, allowing subsequent functions to be called with root privileges.
Risk Assessment
The attack surface is rather limited for users, but an attacker could craft a starter config to delete any directory on the host filesystems.
Recommendation
It is recommended to upgrade to Apptainer version 1.2.1, which includes a security fix. There are no known workarounds outside of this upgrade.
Original NVD description (English source)
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.