Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer
Date: 2023-04
Affected: go/github.com/apptainer/apptainer
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-30549
CWE: CWE-416
CVSS: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Impact There is an ext4 use-after-free flaw described in CVE-2022-1184 that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation. ### Background Historically there have been many CVEs published for extfs and a smaller number for squashfs, including serious use-after-free and buffer overrun vulnerabilities, that are scored as "Moderate" or "Low" impact only because unprivileged users were assumed to not have write access to the raw data. Because of those ratings, vendors treat such CVEs as low urgency and either delay a patch until their next major release or never patch older but still supported operating systems at all. Many Linux distributions automatically mount user-writable USB-drive volumes, but those are considered low risk because they require physical access to the machine. However, since setuid-root installations of Apptainer by default allow all users to mount any extfs (specifically, ext3, which is implemented by the ext4 driver) and squashfs filesystem using kernel drivers even though the users have write access to the raw data, the setuid-root installations rais


Mitigations:

Architectural layers (MAESTRO):