CVE-2019-11328: Incorrect Permission Assignment for Critical Resource in Singularity
Summary
CVE-2019-11328: Incorrect Permission Assignment for Critical Resource in Singularity. Affects github.com/sylabs/singularity versions >= 3.1.0, < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Singularity is an open-source container platform designed to enable secure and reproducible scientific workflows. It allows users to create and run containers that encapsulate their applications and dependencies. Singularity provides a runtime environment for executing these containers, ensuring isolation and portability. However, versions 3.1.0 to 3.2.0-rc2 of Singularity are vulnerable to an incorrect permission assignment issue.
Vulnerability Detail
The vulnerability arises from insecure permissions within the Singularity system. A malicious user with local/network access to the host system can exploit this vulnerability by editing files within the directory /run/singularity/instances/sing/<user>/<instance>. By manipulating these files, the attacker can modify the behavior of the starter-suid program when instances are joined, potentially leading to privilege escalation on the host. This vulnerability poses a significant risk as it allows an unauthorized user to gain elevated privileges on the system.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/sylabs/singularity@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
go get github.com/sylabs/singularity@v3.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually adjust the permissions of the /run/singularity/instances/sing/<user>/<instance> directory to restrict access. By setting appropriate permissions, such as limiting write access to authorized users only, the risk of unauthorized manipulation of files within the directory can be reduced. However, this workaround is not a permanent solution and should be followed by updating to the latest version of Singularity.
Conclusion
The vulnerability in Singularity versions 3.1.0 to 3.2.0-rc2 allows a malicious user to exploit insecure permissions and potentially escalate privileges on the host system. It is crucial to update to Singularity version 3.2.0 or later to mitigate this risk. Additionally, users can apply a temporary workaround by adjusting directory permissions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/sylabs/singularity →
FAQ
Singularity is an open-source container platform that enables secure and reproducible scientific workflows. It allows users to create and run containers encapsulating their applications and dependencies.
Versions 3.1.0 to 3.2.0-rc2 of Singularity are affected by this vulnerability.
This vulnerability allows a malicious user to gain elevated privileges on the host system, potentially leading to unauthorized access and control over sensitive resources.
To fix this vulnerability, it is recommended to update Singularity to version 3.2.0 or later. This update addresses the insecure permission assignment and ensures secure execution of Singularity containers.
Yes, as a temporary workaround, users can manually adjust the permissions of the /run/singularity/instances/sing/<user>/<instance> directory to restrict access. However, this should be followed by updating to the latest version of Singularity for a permanent solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sylabs/singularity.
