CVE-2019-7304
published 2019-04-23CVE-2019-7304: Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue…
PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
57.48%
99.0th percentile
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | snapd | < 2.37.1 | 2.37.1 |
| canonical | snapd | >= unspecified < 2.37.1 | 2.37.1 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | snapd | < snapd 2.37.1-1 (bookworm) | snapd 2.37.1-1 (bookworm) |
| snapcraft | snapd | >= 0 < 2.37.1-1 | 2.37.1-1 |
| snapcraft | snapd | >= 0 < 2.37.1-1 | 2.37.1-1 |
| snapcraft | snapd | >= 0 < 2.37.1-1 | 2.37.1-1 |
| snapcraft | snapd | >= 0 < 2.37.1-1 | 2.37.1-1 |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /v2/create-user HTTP/1.1
Host: localhost
Content-Length: ...
{"email": "...", "sudoer": true, "force-managed": true}↗
- →Detect exploit socket file creation: monitor for UNIX socket files in /tmp/ whose filename contains the pattern ';uid=0;' — this is the core injection string used to spoof UID in snapd's ucrednet.go peer data parsing. ↗
- →Alert on connections to /run/snapd.socket from processes whose socket file path contains ';uid=0;', indicating dirty_sock exploitation attempt. ↗
- →Monitor for installation of 'devmode' snaps via POST /v2/snaps from local unprivileged users — v2 of the exploit installs a trojan devmode snap with an install hook running as root. ↗
- →Detect creation of a new local user named 'dirty_sock' with sudo rights — this is the default account created by dirty_sockv2 upon successful exploitation. ↗
- →The vulnerability resides in snapd's ucrednet.go socket peer data parsing; the injected string ';uid=0;' in the socket filename overwrites the UID variable. Audit snapd versions 2.28 through 2.37 as vulnerable. ↗
- ·Exploit v1 requires an outbound Internet connection (to query Ubuntu SSO) and SSH service accessible via localhost; v2 works without Internet or SSH but requires snapd sideloading components. ↗
- ·On Ubuntu systems with snaps installed, snapd may have already auto-updated to the patched version 2.37.1; verify with 'snap version' before testing. ↗
- ·On older Ubuntu systems (e.g., 16.04), v2 exploit may trigger installation of missing snapd sideloading dependencies, which could cause snapd to upgrade itself to a non-vulnerable version — yet testing shows the exploit still succeeds in this scenario. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_debian9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
snapd vulnerability
vendor_ubuntu·2019-02-12
CVE-2019-7304 snapd vulnerability
Title: snapd vulnerability
Summary: snapd could be made to run programs as an administrator.
Chris Moberly discovered that snapd versions 2.28 through 2.37 incorrectly
validated and parsed the remote socket address when performing access
controls on its UNIX socket. A local attacker could use this to access
privileged socket APIs and obtain administrator privileges. On Ubuntu
systems with snaps installed, snapd typically will have already
automatically refreshed itself to snapd 2.37.1 which is unaffected.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2019-7304: snapd - Canonical snapd before version 2.37.1 incorrectly performed socket owner validat...
vendor_debian·2019·CVSS 9.8
CVE-2019-7304 [CRITICAL] CVE-2019-7304: snapd - Canonical snapd before version 2.37.1 incorrectly performed socket owner validat...
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
Scope: local
bookworm: resolved (fixed in 2.37.1-1)
bullseye: resolved (fixed in 2.37.1-1)
forky: resolved (fixed in 2.37.1-1)
sid: resolved (fixed in 2.37.1-1)
trixie: resolved (fixed in 2.37.1-1)
GHSA
GHSA-jvm5-cj73-m9qg: Canonical snapd before version 2
ghsa_unreviewed·2022-05-24
CVE-2019-7304 [CRITICAL] CWE-863 GHSA-jvm5-cj73-m9qg: Canonical snapd before version 2
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
OSV
CVE-2019-7304: Canonical snapd before version 2
osv·2019-04-23·CVSS 9.8
CVE-2019-7304 [CRITICAL] CVE-2019-7304: Canonical snapd before version 2
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
No detection rules found.
Exploit-DB
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)
exploitdb·2019-02-13
CVE-2019-7304 snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)
snapd blog posting here.
You can easily check if your system is vulnerable. Run the command below. If your `snapd` is 2.37.1 or newer, you are safe.
```
$ snap version
...
snapd 2.37.1
...
```
# Usage
## Version One (use in most cases)
This exploit bypasses access control checks to use a restricted API function (POST /v2/create-user) of the local snapd service. This queries the Ubuntu SSO for a username and public SSH key of a provided email address, and then creates a local user based on these value.
Successful exploitation for this version requires an outbound Internet connection and an SSH service accessible via localhost.
To exploit, first create an account at the Ubuntu SSO. After confirming it, edit your profile and upload an SSH public key. Then, run the exploit like this (with
Exploit-DB
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)
exploitdb·2019-02-13
CVE-2019-7304 snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)
snapd blog posting here.
You can easily check if your system is vulnerable. Run the command below. If your `snapd` is 2.37.1 or newer, you are safe.
```
$ snap version
...
snapd 2.37.1
...
```
# Usage
## Version One (use in most cases)
This exploit bypasses access control checks to use a restricted API function (POST /v2/create-user) of the local snapd service. This queries the Ubuntu SSO for a username and public SSH key of a provided email address, and then creates a local user based on these value.
Successful exploitation for this version requires an outbound Internet connection and an SSH service accessible via localhost.
To exploit, first create an account at the Ubuntu SSO. After confirming it, edit your profile and upload an SSH public key. Then, run the exploit like this (with
2019-04-23
Published