CVE-2019-7304: canonical snapd Incorrect Authorization
Vulnerability summary
CVE-2019-7304 is a high (CVSS 10.0) Incorrect Authorization vulnerability in canonical snapd. EPSS estimates a 60.81% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 23-04-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST8.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
60.81%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 60.81% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundsnapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)
Maturity: poc
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Canonical2 products
- snapd≥ unspecified, < 2.37.1 | < 2.37.1
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
Debian1 product
- snapd< 2.37.1-1
Ubuntu1 product
- snapd< 2.34.2~14.04.1 | < 2.34.2ubuntu0.1 | < 2.34.2+18.04.1
3 vendors · 4 products
