CVE-2019-11503: snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling…

high7.5CVSS 3.0

AVNACLPRNUINSUCNIHAN

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass."

Affected

6 ranges

Vendor	Product	Version range	Fixed in
canonical	snapd	< 2.39	2.39
debian	snapd	< snapd 2.40-1 (bookworm)	snapd 2.40-1 (bookworm)
snapcraft	snapd	>= 0 < 2.40-1	2.40-1
snapcraft	snapd	>= 0 < 2.40-1	2.40-1
snapcraft	snapd	>= 0 < 2.40-1	2.40-1
snapcraft	snapd	>= 0 < 2.40-1	2.40-1

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

osv7.5HIGH