CVE-2019-11328

Published May 14, 2019

Last updated a year ago

Overview

Description: An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 9
Impact score: 10
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:C/I:C/A:C

Weaknesses

nvd@nist.gov: CWE-732

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A03C5294-152B-4B8C-A3C9-C12F336E3CF8",
            "versionEndExcluding": "3.2.0",
            "versionStartIncluding": "3.1.0"
          },
          {
            "criteria": "cpe:2.3:a:sylabs:singularity:3.2.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DCF1D191-8AE3-45AB-A8B8-5FE0495AFDF0"
          },
          {
            "criteria": "cpe:2.3:a:sylabs:singularity:3.2.0:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CD87FF8D-26D4-42AE-9D6B-BC49773D6A4E"
          },
          {
            "criteria": "cpe:2.3:a:sylabs:singularity:3.2.0:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9893E982-1FA4-474C-9FC0-5B08BEA1937D"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DC1BD7B7-6D88-42B8-878E-F1318CA5FCAF"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D100F7CE-FC64-4CC6-852A-6136D72DA419"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:opensuse:backports:sle-15:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "398716BC-E609-4338-BAB9-7CB2A78599BC"
          },
          {
            "criteria": "cpe:2.3:o:opensuse:backports:sle-15:sp1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C84D9410-31B7-421A-AD99-8ED2E45A9BC6"
          },
          {
            "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References