CVE-2025-65105
📋 TL;DR
This vulnerability in Apptainer allows containers to bypass AppArmor and SELinux security restrictions when using the --security option. It affects unprivileged users on systems where these security modules are enabled, primarily on Debian-based and RHEL-based distributions. The issue could allow containers to perform operations that should be restricted by security policies.
💻 Affected Systems
- Apptainer
📦 What is this software?
Apptainer by Lfprojects
⚠️ Risk & Real-World Impact
Worst Case
Container escapes or privilege escalation allowing attackers to break out of container isolation and access host system resources.
Likely Case
Containers bypassing intended security restrictions to perform unauthorized operations within the container environment.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are already implemented.
🎯 Exploit Status
Exploitation requires user access to run containers with the --security option. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.5
Vendor Advisory: https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j
Restart Required: No
Instructions:
1. Update Apptainer to version 1.4.5 or later using your package manager. 2. For source installations: git clone, checkout v1.4.5, build and install. 3. Verify installation with 'apptainer version'.
🔧 Temporary Workarounds
Disable vulnerable --security options
linuxRestrict usage of --security=apparmor and --security=selinux options for unprivileged users
# Configure Apptainer to restrict these options
# Modify apptainer.conf to limit security options
Use container runtime security
linuxImplement additional container security controls like seccomp profiles and capabilities restrictions
# Use seccomp profiles: apptainer run --security seccomp:profile.json
# Restrict capabilities: apptainer run --security capabilities:keep=CAP_NET_BIND_SERVICE
🧯 If You Can't Patch
- Implement strict user access controls to limit who can run containers with --security options.
- Use mandatory access control systems at the host level to restrict container behaviors.
🔍 How to Verify
Check if Vulnerable:
Run 'apptainer version' and check if version is less than 1.4.5. Also verify if AppArmor or SELinux is enabled on the system.Check Version:
apptainer versionVerify Fix Applied:
After updating, run 'apptainer version' to confirm version 1.4.5 or higher is installed.📡 Detection & Monitoring
Log Indicators:
- Unusual container execution with --security options
- Failed AppArmor/SELinux policy enforcement logs
- Container processes attempting restricted operations
Network Indicators:
- Containers making unexpected network connections that should be blocked by security policies
SIEM Query:
source="apptainer" AND ("--security=apparmor" OR "--security=selinux")🔗 References
- https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981
- https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2
- https://github.com/apptainer/apptainer/pull/3226
- https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j
- https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
- https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87
