Summary
Neil McPhail discovered that snapd did not properly restrict writes to the
$HOME/bin path in the AppArmor profile for snaps using the home plug. An
attacker who could convince a user to install a malicious snap could use this
vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type when
extracting a snap. An attacker who could convince a user to install a malicious
snap containing non-regular files could then cause snapd to block indefinitely
while trying to read from such files and cause a denial of
service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the destination of
symbolic links when extracting a snap. An attacker who could convince a user to
install a malicious snap containing crafted symbolic links could then cause
snapd to write out the contents of the symbolic link destination into a
world-readable directory. This in-turn could allow a local unprivileged user to
gain access to privileged information. (CVE-2024-29069)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | snapd | 2.63+20.04ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | snapd | 2.63+22.04ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | snapd | 2.63+24.04ubuntu0.1 |
Vulnerabilities 3
-
Medium 6.3
snapd allows $HOME/bin symlink
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a…
-
Medium 5.8
snapd non-regular file indefinite blocking read
In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries with…
-
Medium 4.8
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the s…