SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. The attacker must cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. The attacker must also control the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and
    SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations
    then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is
    ineffective. The attacker must cause the user to run a malicious container image that redirects the mount
    of /proc to the destination of a shared mount, either known to be configured on the target system, or that
    will be specified by the user when running the container. The attacker must also control the content of
    the shared mount, for example through another malicious container which also binds it, or as a user with
    relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE
    4.3.5 and SingularityPRO 4.1.11 and 4.3.5. (CVE-2025-64750)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and     SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations     then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is     ineffective. The attacker must cause the user to run a malicious container image that redirects the mount     of /proc to the destination of a shared mount, either known to be configured on the target system, or that     will be specified by the user when running the container. The attacker must also control the content of     the shared mount, for example through another malicious container which also binds it, or as a user with     relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE     4.3.5 and SingularityPRO 4.1.11 and 4.3.5. (CVE-2025-64750)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
436247	Alpine: multiple singularity packages: security update to 4.3.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
436247	Alpine: multiple singularity packages: security update to 4.3.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
277419	Linux Distros Unpatched Vulnerability : CVE-2025-64750	Nessus	Misc.	Local	medium
436196	SCA: security update for github.com/sylabs/singularity/v4 (GHSA-wwrx-w7c9-rf87)	Tenable Cloud Security	SCA Checks	Local	medium
436196	SCA: security update for github.com/sylabs/singularity/v4 (GHSA-wwrx-w7c9-rf87)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-64750

medium

Tenable Plugins

medium

medium

medium

medium

medium