LSM restriction bypass via redirected label writes

LSM label bypass in Sylabs SingularityCE before 4.1.11 and 4.2.0-rc.1 through 4.3.4 allows attackers to evade container restrictions. Native mode opens process or thread attr/exec beneath /proc without first ensuring that the path belongs to genuine procfs, so a crafted container image can redirect the label write to an ineffective destination. Exploitation requires a user to run the malicious image with a --security label and requires attacker control of a shared mount; non-root execution does not grant privilege escalation.