7.5

CVE-2019-7303: canonical snapd

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2019-7303USN-3917-1DEBIAN-CVE-2019-7303
Published 23-04-2019Last modified 17-09-2024
Open JSON

Vulnerability summary

CVE-2019-7303 is a high (CVSS 7.5) vulnerability in canonical snapd. EPSS estimates a 3.70% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
41/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
3.70%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Timeline

  1. 23-04-2019
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.

CVSS metrics

7 scores · 4 sources · 3 versions

EPSS trend

Probability

3.70%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.70% on 18-09-2026

18-09-202618-10-2026
EPSS score
3.70%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • exploit-databasedoslinuxVerified

    snap - seccomp BBlacklist for TIOCSTI can be Circumvented

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Canonical2 products
  • snapd≥ unspecified, < 2.37.4 | < 2.37.4
  • ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Debian1 product
  • snapd< 2.37.4-1
Ubuntu1 product
  • snapd< 2.37.4~14.04.1 | < 2.37.4ubuntu0.1 | < 2.37.4+18.04.1

3 vendors · 4 products

References

8 links