PT-2020-12931 · Canonical+1 · Snapd+3

Ian Johnson · Published 2020-07-15 · Updated 2021-11-04 · CVE-2020-11933

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions snapd versions prior to 2.45.2 Ubuntu Core versions prior to 2.45.2

Description A physical attacker could exploit this issue by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device, bypassing intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems.

Recommendations For snapd versions prior to 2.45.2, update to version 2.45.2 or later. For Ubuntu Core versions prior to 2.45.2, update to version 2.45.2 or later. As a temporary workaround, consider restricting access to external media to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2020-11933

USN-4424-1

Affected Products

Linuxmint

Ubuntu

Ubuntu Core

Snapd

References · 9

• https://ubuntu.com/USN-4424-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4424-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11933 · Security Note
• https://ubuntu.com/security/notices/USN-4424-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11934 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11933 · Vendor Advisory
• https://launchpad.net/bugs/1879530 · Note
• https://t.me/cibsecurity/13740 · Telegram Post