Canonical snapd up to 2.61 SquashFS File Parser denial of service

Summaryinfo

A vulnerability was found in Canonical snapd up to 2.61. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component SquashFS File Parser. The manipulation leads to denial of service. This vulnerability is traded as CVE-2024-29068. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Canonical snapd up to 2.61. This issue affects an unknown code block of the component SquashFS File Parser. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

The weakness was shared by Zeyad Gouda as b66fee81606a1c05f965a876ccbaf44174194063. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-29068 since 03/15/2024. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 239945 (TencentOS Server 4: snapd (TSSA-2025:0174)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.62 eliminates this vulnerability. Applying the patch b66fee81606a1c05f965a876ccbaf44174194063 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (239945). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Canonical

Name

• snapd

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40
• 2.41
• 2.42
• 2.43
• 2.44
• 2.45
• 2.46
• 2.47
• 2.48
• 2.49
• 2.50
• 2.51
• 2.52
• 2.53
• 2.54
• 2.55
• 2.56
• 2.57
• 2.58
• 2.59
• 2.60
• 2.61

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion