CVE-2020-11933: high-severity vulnerability in Canonical snapd
local snapd exploit through cloud-init
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.2%
exploitation probability
0.2%top 89% of all CVEs
observed exploitation
nono source reports it
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Related CVEs — Canonical snapd
In the same product, most dangerous first.
CVE-2019-7304HIGHLocal privilege escalation via snapd socketEPSS 60.8%CVE-2019-7303MEDIUMSnapd seccomp filter TIOCSTI ioctl bypassEPSS 3.7%CVE-2020-11934MEDIUMSandbox escape vulnerability via snapctl user-open (xdg-open)EPSS 0.4%CVE-2024-29069MEDIUMsnapd will follow archived symlinks when unpacking a filesystemEPSS 0.2%CVE-2024-29068MEDIUMsnapd non-regular file indefinite blocking readEPSS 0.2%