CVE-2023-1523
published 2023-09-01CVE-2023-1523: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary…
PriorityP262critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
1.45%
70.4th percentile
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | snapd | < 2.59.5 | 2.59.5 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | snapd | < snapd 2.59.5-1 (forky) | snapd 2.59.5-1 (forky) |
| github.com | apptainer_apptainer | >= 1.2.0 < 1.2.1 | 1.2.1 |
| snapcraft | snapd | >= 0 < 2.59.5-1 | 2.59.5-1 |
| snapcraft | snapd | >= 0 < 2.59.5-1 | 2.59.5-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect use of the TIOCLINUX ioctl request from within a snap process; this is the specific syscall+argument combination exploited to inject input into the controlling terminal. ↗
- →Exploitation is only possible when a snap is run on a virtual console (e.g., /dev/tty1–tty6), not under graphical terminal emulators. Scope detection/alerting to processes attached to virtual consoles. ↗
- →Monitor for arbitrary command execution occurring in the terminal session *after* a snap process exits — the injected commands run outside the snap sandbox post-exit, which may appear as orphaned or unexpected shell commands in the parent session. ↗
- ·Only strict-mode snaps are affected; the sandbox bypass applies specifically to snaps running in strict confinement that are not blocked from issuing TIOCLINUX ioctl calls. ↗
- ·Graphical terminal emulators (xterm, gnome-terminal, etc.) are NOT affected; exploitation requires the snap to be running on a virtual console. ↗
- ·Fixed in snapd version 2.59.5-1 on Debian (forky/sid/trixie). Ensure snapd is updated to at least this version to remediate the vulnerability. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
osv10.0CRITICAL
vendor_debian10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
snapd vulnerability
vendor_ubuntu·2023-05-31
CVE-2023-1523 snapd vulnerability
Title: snapd vulnerability
Summary: An intended access restriction in snapd could be bypassed by strict mode snaps.
It was discovered that the snap sandbox did not restrict the use of the
ioctl system call with a TIOCLINUX request. This could be exploited by a
malicious snap to inject commands into the controlling terminal which would
then be executed outside of the snap sandbox once the snap had exited. This
could allow an attacker to execute arbitrary commands outside of the
confined snap sandbox. Note: graphical terminal emulators like xterm,
gnome-terminal and others are not affected - this can only be exploited
when snaps are run on a virtual console.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2023-1523: snapd - Using the TIOCLINUX ioctl request, a malicious snap could inject contents into t...
vendor_debian·2023·CVSS 10.0
CVE-2023-1523 [CRITICAL] CVE-2023-1523: snapd - Using the TIOCLINUX ioctl request, a malicious snap could inject contents into t...
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.59.5-1)
sid: resolved (fixed in 2.59.5-1)
trixie: resolved (fixed in 2.59.5-1)
GHSA
GHSA-55wx-23fj-c2v5: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arb
ghsa_unreviewed·2023-09-01
CVE-2023-1523 [CRITICAL] CWE-74 GHSA-55wx-23fj-c2v5: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arb
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
OSV
CVE-2023-1523: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arb
osv·2023-09-01·CVSS 10.0
CVE-2023-1523 [CRITICAL] CVE-2023-1523: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arb
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
GHSA
Ineffective privileges drop when requesting container network
ghsa·2023-07-25
CVE-2023-38496 [MEDIUM] CWE-269 Ineffective privileges drop when requesting container network
Ineffective privileges drop when requesting container network
### Impact
Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer 1.2.0-rc.2 has introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges. The attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. Only affects setuid installations of Apptainer.
### Patches
The security fix https://github.com/apptainer/apptainer/pull/1578 has been included in Apptainer 1.2.1
### Workarounds
There is no known workaround outside of upgrading to Apptainer 1.2.1
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523https://github.com/snapcore/snapd/pull/12849https://marc.info/?l=oss-security&m=167879021709955&w=2https://ubuntu.com/security/notices/USN-6125-1https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523https://github.com/snapcore/snapd/pull/12849https://marc.info/?l=oss-security&m=167879021709955&w=2https://ubuntu.com/security/notices/USN-6125-1
2023-09-01
Published