PT-2024-18253 · Canonical+3 · Snapd+4

Govulnbot + 1 · Published 2024-07-01 · Updated 2025-01-13 · CVE-2024-1724

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions snapd versions prior to 2.62

Description The issue arises when using AppArmor for enforcement of sandbox permissions in snapd. It failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker could convince a user to install a malicious snap that uses the 'home' plug, allowing them to install arbitrary scripts into the users PATH. These scripts may then be run by the user outside of the expected snap sandbox, enabling them to escape confinement.

Recommendations To resolve the issue, update to snapd version 2.62 or later. As a temporary workaround, consider restricting access to the 'home' plug for snaps until the update is applied. Additionally, users can manually remove any suspicious scripts from the $HOME/bin path to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2024-13230

CVE-2024-1724

GHSA-4MH8-9689-38VR

GO-2024-3007

USN-6940-1

USN-6940-2

Affected Products

Alt Linux

Debian

Linuxmint

Ubuntu

Snapd

References · 31

• 🔥 https://gld.mcphail.uk/posts/explaining-cve-2024-1724 · Exploit
• https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6 · Patch
• https://github.com/snapcore/snapd/pull/13689 · Patch
• https://cve.org/CVERecord?id=CVE-2024-1724 · Security Note
• https://osv.dev/vulnerability/GHSA-4mh8-9689-38vr · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29069 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29068 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1724 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6940-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6940-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1724 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-1724 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-1724 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1724 · Security Note