Critical severity · published Sep 1, 2023
CVE-2023-1523
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be…
10.0
CVSS
1.4%
EPSS
No
On KEV
Description
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Snapd · Canonical
before 2.59.5 · source: NVD
UL
Ubuntu Linux · Canonical
16.04; 18.04; 20.04; 22.04; 22.10; 23.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1523
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1523
Third Party Advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523
Issue Tracking
https://github.com/snapcore/snapd/pull/12849
Exploit
https://marc.info/?l=oss-security&m=167879021709955&w=2
Third Party Advisory
https://ubuntu.com/security/notices/USN-6125-1
More from Snapd
9.8
CVE-2019-7304
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root
8.8
CVE-2020-27352
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the…
8.8
CVE-2021-44730
snapd 2.54.2 did not properly validate the location of the snap-confine binary
8.2
CVE-2024-1724
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path
8.1
CVE-2024-5138
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap