CVE-2018-12021
Singularity Incorrect Access Control
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
CVE-2018-12021- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 6.8 Medium
AV:N/AC:L/Au:S/C:C/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
CVE-2018-12021- Updated
- 2026-11-02
EUVDEUVD-2022-2468 No score
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
EUVD-2022-2468- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4x32-h296-rg6j
Singularity Incorrect Access Control
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
GHSA-4x32-h296-rg6j- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
CVE-2018-12021- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-4x32-h296-rg6j
Singularity Incorrect Access Control
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
GHSA-4x32-h296-rg6j- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2018-12021
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
- Record
UBUNTU-CVE-2018-12021- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2018:1969-1 No score
Security update for singularity
This update for singularity fixes the following issues:
- CVE-2018-12021: A race condition might have allowed malicious users to bypass directory image restrictions, like mounting the host root filesystem as a container image (boo#1100333)
- Record
openSUSE-SU-2018:1969-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0095-1 No score
Security update for singularity
This update for singularity to version 2.6.1 fixes the following issues:
Security issues fixed:
- CVE-2018-19295: Mount points are not mounted with shared mount propagation by default anymore, as this may result in privilege escalation (boo#1111411).
- CVE-2018-12021: Fixed a incorrect access control issues on systems supporting overlay file system (boo#1100333).
- Record
openSUSE-SU-2019:0095-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11384-1 No score
singularity-3.8.3-1.2 on GA media
These are all security issues fixed in the singularity-3.8.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11384-1- Updated
- 2026-11-02
OSVUSN-4840-1 No score
singularity-container vulnerabilities
It was discovered that Singularity incorrectly handled certain inputs. An attacker could possibly use this issue to obtain sensitive information. (CVE-2018-19295)
It was discovered that Singularity incorrectly handled access control. An attacker could possibly use this issue to obtain sensitive information. (CVE-2018-12021)
- Record
USN-4840-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hpcng/singularityGo |
2.3.0 to 2.5.1 | 2.5.2 |
github.com/hpcng/singularityGo |
2.3.0 up to 2.5.2 | 2.5.2 |
singularity-containerUbuntu:Pro:18.04:LTS |
before 2.4.2-4ubuntu0.1~esm1, plus listed versions 2.3.1-22.3.2-12.4.1-12.4.2-22.4.2-32.4.2-4 |
2.4.2-4ubuntu0.1~esm1 |
singularity-containerUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 2.4.2-4ubuntu0.1~esm1, plus listed versions 2.3.1-22.3.2-12.4.1-12.4.2-22.4.2-32.4.2-4 |
2.4.2-4ubuntu0.1~esm1 |
singularitySUSE:Package Hub 12 SP3 |
before 2.3.2-11.1 | 2.3.2-11.1 |
singularitySUSE:Package Hub 12 SP3 From an advisory covering 2 CVEs |
before 2.6.1-14.1 | 2.6.1-14.1 |
singularityopenSUSE:Tumbleweed From an advisory covering 12 CVEs |
before 3.8.3-1.2 | 3.8.3-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-12021 is a medium vulnerability (CVSS 6.5) in Sylabs Singularity, published July 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in github.com/hpcng/singularity 2.5.2.
References
github.com/singularityware/singularity/releases/tag/2.5.2
openwall.com/lists/oss-security/2019/05/16/1
nvd.nist.gov/vuln/detail/CVE-2018-12021
ubuntu.com/security/CVE-2018-12021
Show 19 moreShow less
cve.org/CVERecord?id=CVE-2018-12021
lists.opensuse.org/archives/list/[email protected]/thread/BVVOAO2DTGDEH4FUXRM34QLEZB7OALKO
bugzilla.suse.com/1100333
suse.com/security/cve/CVE-2018-12021