CVE-2024-1724
published 2024-07-25CVE-2024-1724: In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu…
PriorityP341high8.2CVSS 3.1
AVLACLPRLUIRSCCHIHAH
EPSS
0.31%
22.4th percentile
In snapd versions prior to 2.62, when using AppArmor for enforcement of
sandbox permissions, snapd failed to restrict writes to the $HOME/bin
path. In Ubuntu, when this path exists, it is automatically added to
the users PATH. An attacker who could convince a user to install a
malicious snap which used the 'home' plug could use this vulnerability
to install arbitrary scripts into the users PATH which may then be run
by the user outside of the expected snap sandbox and hence allow them
to escape confinement.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actions | artifact | >= 2.0.0 < 2.1.2 | 2.1.2 |
| canonical | snap | < 2.62 | 2.62 |
| canonical | snapd | < 2.62 | 2.62 |
| debian | snapd | < snapd 2.62-1 (forky) | snapd 2.62-1 (forky) |
| github.com | snapcore_snapd | >= 0 < 2.62 | 2.62 |
| snapcraft | snapd | >= 0 < 2.62-1 | 2.62-1 |
| snapcraft | snapd | >= 0 < 2.62-1 | 2.62-1 |
| snapcraft | snapd | >= 0 < 2.63+20.04ubuntu0.1 | 2.63+20.04ubuntu0.1 |
| snapcraft | snapd | >= 0 < 2.63+22.04ubuntu0.1 | 2.63+22.04ubuntu0.1 |
| snapcraft | snapd | >= 0 < 2.63+24.04ubuntu0.1 | 2.63+24.04ubuntu0.1 |
| snapcraft | snapd | >= 0 < 2.61.4ubuntu0.16.04.1+esm1 | 2.61.4ubuntu0.16.04.1+esm1 |
| snapcraft | snapd | >= 0 < 2.61.4ubuntu0.18.04.1+esm1 | 2.61.4ubuntu0.18.04.1+esm1 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
ghsa7.5HIGH
osv8.2HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
vendor_ubuntu6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
snapd vulnerabilities
osv·2025-01-13·CVSS 8.2
CVE-2024-1724 [HIGH] snapd vulnerabilities
snapd vulnerabilities
USN-6940-1 fixed vulnerabilities in snapd. This update provides the
corresponding updates for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.
Original advisory details:
Neil McPhail discovered that snapd did not properly restrict writes to
the /home/jslarraz/bin path in the AppArmor profile for snaps using the home
plug. An attacker who could convince a user to install a malicious snap
could use this vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type
when extracting a snap. An attacker who could convince a user to install
a malicious snap containing non-regular files could then cause snapd to
block indefinitely while trying to read from such files and cause a
denial of service. (CVE-2024-29068)
GHSA
@actions/artifact has an Arbitrary File Write via artifact extraction
ghsa·2024-09-03·CVSS 7.5
CVE-2024-42471 [HIGH] CWE-22 @actions/artifact has an Arbitrary File Write via artifact extraction
@actions/artifact has an Arbitrary File Write via artifact extraction
### Impact
Versions of `actions/artifact` before 2.1.7 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames.
### Patches
Upgrade to version 2.1.7 or higher.
### References
- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/actions/toolkit/pull/1724
### CVE
CVE-2024-42471
### Credits
Justin Taft from Google
OSV
snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd
osv·2024-08-06
CVE-2024-1724 snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd
snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd
snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/snapcore/snapd before v2.62.0.
OSV
snapd vulnerabilities
osv·2024-08-01·CVSS 8.2
CVE-2024-1724 [HIGH] snapd vulnerabilities
snapd vulnerabilities
Neil McPhail discovered that snapd did not properly restrict writes to the
$HOME/bin path in the AppArmor profile for snaps using the home plug. An
attacker who could convince a user to install a malicious snap could use this
vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type when
extracting a snap. An attacker who could convince a user to install a malicious
snap containing non-regular files could then cause snapd to block indefinitely
while trying to read from such files and cause a denial of
service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the destination of
symbolic links when extracting a snap. An attacker who could convince a user to
install a m
OSV
snapd failed to restrict writes to the $HOME/bin path
osv·2024-07-25
CVE-2024-1724 [MEDIUM] snapd failed to restrict writes to the $HOME/bin path
snapd failed to restrict writes to the $HOME/bin path
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.
OSV
CVE-2024-1724: In snapd versions prior to 2
osv·2024-07-25·CVSS 8.2
CVE-2024-1724 [HIGH] CVE-2024-1724: In snapd versions prior to 2
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.
GHSA
snapd failed to restrict writes to the $HOME/bin path
ghsa·2024-07-25
CVE-2024-1724 [MEDIUM] CWE-732 snapd failed to restrict writes to the $HOME/bin path
snapd failed to restrict writes to the $HOME/bin path
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.
Ubuntu
snapd vulnerabilities
vendor_ubuntu·2025-01-13·CVSS 6.3
CVE-2024-29068 [MEDIUM] snapd vulnerabilities
Title: snapd vulnerabilities
Summary: Several security issues were fixed in snapd.
USN-6940-1 fixed vulnerabilities in snapd. This update provides the
corresponding updates for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.
Original advisory details:
Neil McPhail discovered that snapd did not properly restrict writes to
the /home/jslarraz/bin path in the AppArmor profile for snaps using the home
plug. An attacker who could convince a user to install a malicious snap
could use this vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type
when extracting a snap. An attacker who could convince a user to install
a malicious snap containing non-regular files could then cause snapd to
block indefinitely while trying to read f
Ubuntu
snapd vulnerabilities
vendor_ubuntu·2024-08-01·CVSS 6.3
CVE-2024-1724 [MEDIUM] snapd vulnerabilities
Title: snapd vulnerabilities
Summary: Several security issues were fixed in snapd.
Neil McPhail discovered that snapd did not properly restrict writes to the
$HOME/bin path in the AppArmor profile for snaps using the home plug. An
attacker who could convince a user to install a malicious snap could use this
vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type when
extracting a snap. An attacker who could convince a user to install a malicious
snap containing non-regular files could then cause snapd to block indefinitely
while trying to read from such files and cause a denial of
service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the destination of
symbolic links when extractin
Red Hat
snapd: Snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path.
vendor_redhat·2024-07-25·CVSS 6.3
CVE-2024-1724 [MEDIUM] CWE-732 snapd: Snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path.
snapd: Snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path.
In snapd versions prior to 2.62, when using AppArmor for enforcement of
sandbox permissions, snapd failed to restrict writes to the $HOME/bin
path. In Ubuntu, when this path exists, it is automatically added to
the users PATH. An attacker who could convince a user to install a
malicious snap which used the 'home' plug could use this vulnerability
to install arbitrary scripts into the users PATH which may then be run
by the user outside of the expected snap sandbox and hence allow them
to escape confinement.
Statement: This vulnerability doesn't affect the snapd versions as shipped with Fedora Linux or in EPEL repositories as apparmor is n
Debian
CVE-2024-1724: snapd - In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox...
vendor_debian·2024·CVSS 6.3
CVE-2024-1724 [MEDIUM] CVE-2024-1724: snapd - In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox...
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.62-1)
sid: resolved (fixed in 2.62-1)
trixie: resolved (fixed in 2.62-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6https://github.com/snapcore/snapd/pull/13689https://gld.mcphail.uk/posts/explaining-cve-2024-1724/https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6https://github.com/snapcore/snapd/pull/13689https://gld.mcphail.uk/posts/explaining-cve-2024-1724/
2024-07-25
Published