Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.

The remote Ubuntu 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4840-1 advisory.

    It was discovered that Singularity incorrectly handled certain inputs. An attacker could possibly use this     issue to obtain sensitive information. (CVE-2018-19295)

    It was discovered that Singularity incorrectly handled access control. An attacker could possibly use this     issue to obtain sensitive information. (CVE-2018-12021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Singularity was updated to version 2.6.0, bringing features, bugfixes and security fixes.

Security issues fixed :

  - CVE-2018-12021: Fixed access control on systems     supporting overlay file system (boo#1100333).

Highlights of 2.6.0 :

  - Allow admin to specify a non-standard location for     mksquashfs binary at build time with '--with-mksquashfs'     option #1662

  - '--nv' option will use     [nvidia-container-cli](https://github.com/NVIDIA/libnvid     ia-container) if installed #1681

  - [nvliblist.conf]     (https://github.com/singularityware/singularity/blob/mas     ter/etc/nvliblist.conf) now has a section for binaries     #1681

  - '--nv' can be made default with all action commands in     singularity.conf #1681

  - '--nv' can be controlled by env vars '$SINGULARITY_NV'     and '$SINGULARITY_NV_OFF' #1681

  - Restore shim init process for proper signal handling and     child reaping when container is initiated in its own PID     namespace #1221

  - Add '-i' option to image.create to specify the inode     ratio. #1759

  - Bind '/dev/nvidia*' into the container when the '--nv'     flag is used in conjuction with the '--contain' flag     #1358

  - Add '--no-home' option to not mount user $HOME if it is     not the $CWD and 'mount home = yes' is set. #1761

  - Added support for OAUTH2 Docker registries like Azure     Container Registry #1622

Highlights of 2.5.2 :

  - a new `build` command was added to replace `create` +     `bootstrap`

  - default image format is squashfs, eliminating the need     to specify a size

  - a `localimage` can be used as a build base, including     ext3, sandbox, and other squashfs images

  - singularity hub can now be used as a base with the uri

  - Restore docker-extract aufs whiteout handling that     implements correct extraction of docker container     layers.

Bug fixes :

  - Fix 404 when using Arch Linux bootstrap #1731

  - Fix environment variables clearing while starting     instances #1766

  - several more bug fixes, see CHANGELOG.md for details

ID	Name	Product	Family	Severity
183162	Ubuntu 18.04 ESM : Singularity vulnerabilities (USN-4840-1)	Nessus	Ubuntu Local Security Checks	high
123343	openSUSE Security Update : singularity (openSUSE-2019-811)	Nessus	SuSE Local Security Checks	medium
118338	openSUSE Security Update : singularity (openSUSE-2018-1223)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-12021

medium

Tenable Plugins

high

medium

medium