Summary
USN-6940-1 fixed vulnerabilities in snapd. This update provides the
corresponding updates for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.
Original advisory details:
Neil McPhail discovered that snapd did not properly restrict writes to
the /home/jslarraz/bin path in the AppArmor profile for snaps using the home
plug. An attacker who could convince a user to install a malicious snap
could use this vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type
when extracting a snap. An attacker who could convince a user to install
a malicious snap containing non-regular files could then cause snapd to
block indefinitely while trying to read from such files and cause a
denial of service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the
destination of symbolic links when extracting a snap. An attacker who
could convince a user to install a malicious snap containing crafted
symbolic links could then cause snapd to write out the contents of the
symbolic link destination into a world-readable directory. This in-turn
could allow a local unprivileged user to gain access to privileged
information. (CVE-2024-29069)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | snapd | 2.61.4ubuntu0.16.04.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | snapd | 2.61.4ubuntu0.18.04.1+esm1 |
Vulnerabilities 3
-
Medium 6.3
snapd allows $HOME/bin symlink
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a…
-
Medium 5.8
snapd non-regular file indefinite blocking read
In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries with…
-
Medium 4.8
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the s…