Unprivileged User Vulnerability in snapctl Could Allow Denial of Service
CVE-2024-5138

Currently unrated

Key Information:

Vendor
Canonical Ltd.
Status
Snapd
Vendor
CVE Published:
31 May 2024

Badges

📰 News Worthy

Summary

The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.

Affected Version(s)

snapd Linux 0 < 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14

News Articles

favicon imagewww.annanowa.com

CVE-2024-5138 | snapd snapctl access control (GHSA-p9v8-q5m4-pf46) – Annanowa

Contact Me Address: Kuzyaka District Milas Mugla ZIP: 48200 Mobile Phone: 05386281520 E Mail: caglararli @ hotmail.com-caglararli @ gmail.com Web Site: www.caglararli.com.tr –...

References

https://github.com/snapcore/snapd/commit/68ee9c6aa916ab87...
patch
https://bugs.launchpad.net/snapd/+bug/2065077
issue-tracking
https://www.cve.org/CVERecord?id=CVE-2024-5138
issue-tracking

Timeline

  • 📰

    First article discovered by www.annanowa.com

  • Vulnerability published

Credit

Rory McNamara from Snyk Security Labs
.
CVE-2024-5138 : Unprivileged User Vulnerability in snapctl Could Allow Denial of Service | SecurityVulnerability.io