Metro Data published details of a critical vulnerability affecting Singular 4.3.0 and earlier, along with the upstream fix information.
Michael Orlitzky discovered and published CVE-2022-40299, a vulnerability affecting Singular 4.3.0 and earlier. The issue was fixed in commits 72df188 and 5f28fbf0 and in version 4.3.1.
Summary
The Singular interface uses fixed paths under the world-writable /tmp directory for log files and as scratch space for the debugger. An attacker could exploit those paths to overwrite files belonging to the Singular user or, in rare cases, execute code.
The debugger issue could also lead to code execution when an attacker is able to modify a code snippet while it is being loaded from the scratch file back into Singular.
Resolution
The log-file issue was resolved by making the --log flag require a filename. The debugger issue was resolved by using mkstemp() to create the scratch file securely.
About the research
Common Vulnerabilities and Exposures provides standard public identifiers for known cybersecurity vulnerabilities. Metro Data’s Michael J. Orlitzky has been recognized for discovering and helping to remediate vulnerabilities in operating systems and application software.