CVE-2019-11503 — Link Following in Snapd

CWE-59 — Link Following10 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 36.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Snapcraft SnapdCanonical Snapd
Timeline
PublishedApr 24
Latest updateMay 24

Description

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcanonical/snapd< 2.39
▶Debiansnapcraft/snapd< 2.40-1+3

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-w39p-qmcm-pxpm: snap-confine as included in snapd before 2↗2022-05-24
▶
OSV
CVE-2019-11503: snap-confine as included in snapd before 2↗2019-04-24
▶
CVEList
CVE-2019-11503: snap-confine as included in snapd before 2↗2019-04-24
▶

📋Vendor Advisories

1
Debian
CVE-2019-11503: snapd - snap-confine as included in snapd before 2.39 did not guard against symlink race...↗2019
▶

💬Community

5
Bugzilla
CVE-2019-11503 snapd-glib: snapd: remote attacker able to bypass security restriction [fedora-all]↗2019-05-03
▶
Bugzilla
CVE-2019-11503 snapd: remote attacker able to bypass security restriction [epel-7]↗2019-05-03
▶
Bugzilla
CVE-2019-11503 snapd-glib: snapd: remote attacker able to bypass security restriction [epel-7]↗2019-05-03
▶
Bugzilla
CVE-2019-11503 snapd: remote attacker able to bypass security restriction↗2019-05-03
▶
Bugzilla
CVE-2019-11503 snapd: remote attacker able to bypass security restriction [fedora-all]↗2019-05-03
▶
CVE-2019-11503 — Link Following in Canonical Snapd | cvebase