Canonical Ltd. Snapd vulnerabilities

7 vulnerabilities

Known vulnerabilities in Canonical Ltd. Snapd, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.2CVE-2021-4120canonical ltd.snapd+5
EPSS score
0.44%
snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.18.8CVE-2021-44730canonical ltd.snapd+6
EPSS score
0.35%
snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.17.8CVE-2021-44731canonical ltd.snapd+6
EPSS score
0.95%
A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.15.5CVE-2021-3155canonical ltd.snapd+4
EPSS score
0.26%
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.19.3CVE-2020-27352canonical ltd.snapd+4
EPSS score
0.26%
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.7.8CVE-2022-3328canonical ltd.snapd+5
EPSS score
0.38%
Race condition in snap-confine's must_mkdir_and_open_with_perms()8.1CVE-2024-5138canonical ltd.snapd+4
EPSS score
0.83%
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.