CVE-2020-11934: medium-severity vulnerability in Canonical snapd
Sandbox escape vulnerability via snapctl user-open (xdg-open)
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.4%
exploitation probability
0.4%top 72% of all CVEs
observed exploitation
nono source reports it
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected products
Canonical · snapdRelated CVEs — Canonical snapd
In the same product, most dangerous first.
CVE-2019-7304HIGHLocal privilege escalation via snapd socketEPSS 60.8%CVE-2019-7303MEDIUMSnapd seccomp filter TIOCSTI ioctl bypassEPSS 3.7%CVE-2024-29069MEDIUMsnapd will follow archived symlinks when unpacking a filesystemEPSS 0.2%CVE-2020-11933HIGHlocal snapd exploit through cloud-initEPSS 0.2%CVE-2024-29068MEDIUMsnapd non-regular file indefinite blocking readEPSS 0.2%