Read the docs
TI-2025-40088 Aliases CVE-2025-64750GHSA-wwrx-w7c9-rf87

Singluarity ineffectively applies of selinux / apparmor LSM process labels

Priority LOW 20CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. The attacker must cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. The attacker must also control the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Fixed singularity (sylabs): 4.1.11github.com/sylabs/singularity/v4 (Go): 4.3.5, 4.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sylabssingularity> 4.2.0-rc.1, < 4.3.5; before 4.1.114.1.11Patch availableCNA
—github.com/sylabs/singularity/v4 (Go)4.2.0-rc.1 to before 4.3.54.3.5Patch availableGHSA-wwrx-w7c9-rf87
—github.com/sylabs/singularity/v4 (Go)before 4.1.114.1.11Patch availableGHSA-wwrx-w7c9-rf87
  • singularity Vendorsylabs Affected > 4.2.0-rc.1, < 4.3.5; before 4.1.11 Fixed in 4.1.11 Patch available CNA
  • github.com/sylabs/singularity/v4 (Go) Vendor— Affected 4.2.0-rc.1 to before 4.3.5 Fixed in 4.3.5 Patch available GHSA-wwrx-w7c9-rf87
  • github.com/sylabs/singularity/v4 (Go) Vendor— Affected before 4.1.11 Fixed in 4.1.11 Patch available GHSA-wwrx-w7c9-rf87

Remediation

  • Fix · CNA singularity (sylabs) Fixed in 4.1.11
  • Fix · GHSA-wwrx-w7c9-rf87 github.com/sylabs/singularity/v4 (Go) Fixed in 4.3.5 Advisory →
  • Fix · GHSA-wwrx-w7c9-rf87 github.com/sylabs/singularity/v4 (Go) Fixed in 4.1.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64750
  2. 2026-10-03 Alias added: GHSA-wwrx-w7c9-rf87

References

Advisory 2

Other 7

  • TI-2021-12997 Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect… CVSS 3.1CRITICAL 9.8
  • TI-2021-12634 Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. CVSS 3.1CRITICAL 9.8
  • TI-2020-12001 Path traversal and files overwrite with unsquashfs CVSS 3.1CRITICAL 9.3
  • TI-2022-18614 Digital Signature Hash Algorithms Not Validated in sylabs/sif CVSS 3.1CRITICAL 9.8
  • TI-2020-15301 Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used… CVSS 3.1HIGH 8.8
  • TI-2019-08462 An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with… CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences