Skip to content
fr Sign in
7.3 High

CVE-2020-11933 cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every…

Description

cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.

Affected products and versions

Product Affected versions Fixed in
snapd 2.45 2.45.2 → latest No fix stated
core 2.45 2.45.2 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of snapd

The 9 CVEs of snapd →
CVE-2024-29069 In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap 4.8 Medium CVE-2024-29068 In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap 5.8 Medium CVE-2024-1724 In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict… 6.3 Medium CVE-2020-27352 When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify… 9.3 Critical
Track this CVE