snapd up to 2.38 snap-confine chdir link following

Summaryinfo

A vulnerability was found in snapd up to 2.38. It has been rated as critical. Impacted is the function chdir of the component snap-confine. This manipulation causes link following. The identification of this vulnerability is CVE-2019-11503. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in snapd up to 2.38. Affected by this vulnerability is the function chdir of the component snap-confine. The manipulation with an unknown input leads to a link following vulnerability. The CWE definition for the vulnerability is CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass."

The bug was discovered 04/18/2019. The weakness was shared 04/24/2019 (Website). The advisory is shared at lists.fedoraproject.org. This vulnerability is known as CVE-2019-11503 since 04/24/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.39 eliminates this vulnerability.

The entry VDB-134028 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• snapd

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion