CVE-2019-7304: high-severity vulnerability in Canonical snapd
Local privilege escalation via snapd socket
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
61Vexday Risk Score
Keep watching. It has a public proof of concept.
ssvc Attendcvss 8.8epss 61%
from disclosure to weaponsame day
Published on NVDApr 23
1st PoCFeb 12
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Canonical · snapdpublic PoCs found — 8
cve_referencewww.exploit-db.com/exploits/46361unverifiedcve_referencewww.exploit-db.com/exploits/46362unverifiedgithubgithub.com/initstring/dirty_sock★ 680githubgithub.com/SecuritySi/CVE-2019-7304_DirtySock★ 6githubgithub.com/elvi7major/snap_priv_esc★ 1githubgithub.com/f4T1H21/dirty_sock★ 1githubgithub.com/coby-nguyen/Document-Linux-Privilege-Escalation★ 0githubgithub.com/Kaine105/Document-Linux-Privilege-Escalation★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Canonical snapd
In the same product, most dangerous first.
CVE-2019-7303MEDIUMSnapd seccomp filter TIOCSTI ioctl bypassEPSS 3.7%CVE-2020-11934MEDIUMSandbox escape vulnerability via snapctl user-open (xdg-open)EPSS 0.4%CVE-2024-29069MEDIUMsnapd will follow archived symlinks when unpacking a filesystemEPSS 0.2%CVE-2020-11933HIGHlocal snapd exploit through cloud-initEPSS 0.2%CVE-2024-29068MEDIUMsnapd non-regular file indefinite blocking readEPSS 0.2%