CVE-2024-1724

MEDIUM6.3EPSS 0.03%

snapd failed to restrict writes to the $HOME/bin path

發布日:2024/7/25修改日:2024/8/7

也稱為:GHSA-4mh8-9689-38vrGO-2024-3007

描述

In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.

受影響套件(3)

Debian/snapdfrom 0
Go/github.com/snapcore/snapdfrom 0, < 2.62
Go/github.com/snapcore/snapdfrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

參考連結(8)

ADVISORYhttps://github.com/advisories/GHSA-4mh8-9689-38vr
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-1724
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2024-1724
PATCHhttps://github.com/snapcore/snapd
WEBhttps://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6
WEBhttps://github.com/snapcore/snapd/pull/13689
WEBhttps://gld.mcphail.uk/posts/explaining-cve-2024-1724
WEBhttps://pkg.go.dev/vuln/GO-2024-3007