CVE-2020-11934: falha de média gravidade em Canonical snapd
Sandbox escape vulnerability via snapctl user-open (xdg-open)
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.4%
probabilidade de exploração
0.4%top 72% das CVEs
exploração observada
nãonenhuma fonte reporta
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Produtos afetados
Canonical · snapdCVEs relacionadas — Canonical snapd
No mesmo produto, das mais perigosas para as menos.
CVE-2019-7304HIGHLocal privilege escalation via snapd socketEPSS 60.8%CVE-2019-7303MEDIUMSnapd seccomp filter TIOCSTI ioctl bypassEPSS 3.7%CVE-2024-29069MEDIUMsnapd will follow archived symlinks when unpacking a filesystemEPSS 0.2%CVE-2020-11933HIGHlocal snapd exploit through cloud-initEPSS 0.2%CVE-2024-29068MEDIUMsnapd non-regular file indefinite blocking readEPSS 0.2%