snapd non-regular file indefinite blocking read

Also known as GHSA-64jh-cjwc-w8q6, GO-2024-3008

Published 2 y ago 2024-07-25 · modified 58 d ago 2026-09-10 · JSON

CVSS

5.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 11%

Public exploits

none known

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago 2024-07-25

Exploit prediction (EPSS)

0.21% probability of exploitation in the next 30 days, higher than 11% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	5.8	`CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H`
CNA	3.1	5.8	`CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H`
NVD	3.1	6.6	`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H`
GitHub	3.1	5.8	`CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/snapcore/snapd`	<2.62 all versions	2.62

Affected products

Canonical snapd

Classification

Weakness

CWE-20 Improper Input Validation

References

github.com /snapcore/snapd/commit/b66fee81606a1c05f965a876ccbaf44174194063 · x_transferred
github.com /snapcore/snapd/pull/13682 · x_transferred
nvd.nist.gov /vuln/detail/CVE-2024-29068 · advisory
github.com /snapcore/snapd · package
pkg.go.dev /vuln/GO-2024-3008 · web
github.com /advisories/GHSA-64jh-cjwc-w8q6 · advisory

Sources

CVE List: CVE-2024-29068
GitHub Advisory: GHSA-64jh-cjwc-w8q6
NVD: CVE-2024-29068
OSV: GO-2024-3008

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary