Medium severity · published Jul 25, 2024
CVE-2024-29068
In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap
6.6
CVSS
0.2%
EPSS
No
On KEV
Description
In snapd versions prior to 2.62, snapd failed to properly check the file
type when extracting a snap. The snap format is a squashfs file-system
image and so can contain files that are non-regular files (such as pipes
or sockets etc). Various file entries within the snap squashfs image
(such as icons etc) are directly read by snapd when it is extracted. An
attacker who could convince a user to install a malicious snap which
contained non-regular files at these paths could then cause snapd to block
indefinitely trying to read from such files and cause a denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Snapd · Canonical
before 2.62 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29068
Patch
https://github.com/snapcore/snapd/commit/b66fee81606a1c05f965a876ccbaf44174194063
Issue Tracking
https://github.com/snapcore/snapd/pull/13682
More from Snapd
10.0
CVE-2023-1523
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be…
9.8
CVE-2019-7304
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root
8.8
CVE-2020-27352
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the…
8.8
CVE-2021-44730
snapd 2.54.2 did not properly validate the location of the snap-confine binary
8.2
CVE-2024-1724
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path
