CVE-2020-11933
published 2020-07-29CVE-2020-11933: cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit…
PriorityP429medium6.8CVSS 3.1
AVPACLPRNUINSUCHIHAH
EPSS
0.22%
12.2th percentile
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | core | >= 2.45.2 < 2.45.2, revision 9659 | 2.45.2, revision 9659 |
| canonical | snapd | < 2.45.2 | 2.45.2 |
| canonical | snapd | >= 2.45.2 < 2.45.2, revision 8539 | 2.45.2, revision 8539 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| snapcraft | snapd | >= 0 < 2.45.1ubuntu0.2 | 2.45.1ubuntu0.2 |
| snapcraft | snapd | >= 0 < 2.45.1+18.04.2 | 2.45.1+18.04.2 |
| snapcraft | snapd | >= 0 < 2.45.1+20.04.2 | 2.45.1+20.04.2 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_ubuntu7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v343-8p34-76p3: cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker coul
ghsa_unreviewed·2022-05-24
CVE-2020-11933 [MEDIUM] GHSA-v343-8p34-76p3: cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker coul
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
OSV
snapd vulnerabilities
osv·2020-07-15·CVSS 6.8
CVE-2020-11933 [MEDIUM] snapd vulnerabilities
snapd vulnerabilities
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and
Ubuntu Core 18 devices ran on every boot without restrictions. A physical
attacker could exploit this to craft cloud-init user-data/meta-data via
external media to perform arbitrary changes on the device to bypass
intended security mechanisms such as full disk encryption. This issue did
not affect traditional Ubuntu systems. (CVE-2020-11933)
It was discovered that snapctl user-open allowed altering the XDG_DATA_DIRS
environment variable when calling the system xdg-open. A malicious snap
could exploit this to bypass intended access restrictions to control how
the host system xdg-open script opens the URL. This issue did not affect
Ubuntu Core systems. (CVE-2020-11934)
Ubuntu
snapd vulnerabilities
vendor_ubuntu·2020-07-15·CVSS 7.3
CVE-2020-11933 [HIGH] snapd vulnerabilities
Title: snapd vulnerabilities
Summary: An intended access restriction in snapd could be bypassed by strict mode
snaps.
It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and
Ubuntu Core 18 devices ran on every boot without restrictions. A physical
attacker could exploit this to craft cloud-init user-data/meta-data via
external media to perform arbitrary changes on the device to bypass
intended security mechanisms such as full disk encryption. This issue did
not affect traditional Ubuntu systems. (CVE-2020-11933)
It was discovered that snapctl user-open allowed altering the XDG_DATA_DIRS
environment variable when calling the system xdg-open. A malicious snap
could exploit this to bypass intended access restrictions to control how
the host system xdg-open script opens
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-07-29
Published