CVE-2023-38496: Apptainer's ineffective privileges drop when requesting container network
Vulnerability summary
CVE-2023-38496 is a medium (CVSS 6.1) Improper Privilege Management vulnerability in apptainer. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.8% of scored vulnerabilities.
Not severe (CVSS 6.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 25-07-2023PublishedVulnerability first disclosed.
- 10-10-2024Last modifiedVulnerability information updated.
Description
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.26% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-271Privilege Dropping / Lowering ErrorsThe product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
Affected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Apptainer1 product
- apptainer≥ 1.2.0-rc.2, < 1.2.1
Github.com/apptainer1 product
- apptainer≥ 1.2.0, < 1.2.1
Lfprojects1 product
- apptainer1.2.0 | 1.2.0:rc2
Opensuse1 product
- apptainer&distro=openSUSE Tumbleweed< 1.2.1-1.1
4 vendors · 4 products
References
6 links- github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-wxvxX Refsource CONFIRMWEBAdvisoryPatchVendor Advisory
