High severity · published Jun 21, 2024
CVE-2020-27352
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the…
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Snapd · Canonical
before 2.48.3 · source: NVD
UL
Ubuntu Linux · Canonical
16.04; 18.04; 20.04; 20.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27352
Exploit
https://bugs.launchpad.net/snapd/+bug/1910456
Vendor Advisory
https://ubuntu.com/security/notices/USN-4728-1
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-27352
More from Snapd
10.0
CVE-2023-1523
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be…
9.8
CVE-2019-7304
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root
8.8
CVE-2021-44730
snapd 2.54.2 did not properly validate the location of the snap-confine binary
8.2
CVE-2024-1724
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path
8.1
CVE-2024-5138
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap