CVE-2020-27348

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.

CVSS v3 6.8 MEDIUM
CVSS v2.0 4.4 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 5.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugs.launchpad.net/bugs/1901572	Exploit Issue Tracking Third Party Advisory
https://github.com/snapcore/snapcraft/pull/3345	Third Party Advisory
https://usn.ubuntu.com/usn/usn-4661-1	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:canonical:snapcraft:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:16.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:18.04:::::::*

History

No history.

Information

Published : 2020-12-04 03:15

Updated : 2020-12-14 20:36

NVD link : CVE-2020-27348

Mitre link : CVE-2020-27348

CVE.ORG link : CVE-2020-27348

JSON object : View

Products Affected

canonical

ubuntu_linux
snapcraft

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2020-27348", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.3}, {"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.3}]}, "published": "2020-12-04T03:15:12.413", "references": [{"url": "https://bugs.launchpad.net/bugs/1901572", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/snapcore/snapcraft/pull/3345", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://usn.ubuntu.com/usn/usn-4661-1", "tags": ["Patch", "Third Party Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}, {"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1."}, {"lang": "es", "value": "En algunas condiciones, un paquete snap creado por snapcraft incluye el directorio actual en LD_LIBRARY_PATH, permitiendo a un snap malicioso conseguir una ejecuci\u00f3n de c\u00f3digo dentro del contexto de otro snap si ambos conectan la interfaz de inicio o similar. Este problema afecta a Snapcraft versiones anteriores a 4.4.4, anteriores a 2.43.1+16.04.1 y anteriores a 2.43.1+18.04.1"}], "lastModified": "2020-12-14T20:36:00.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:snapcraft:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68DD1264-E95B-4BFB-8E25-EE5AB9090693", "versionEndExcluding": "4.4.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "712507AC-DAB8-4FFE-9426-08282919411F"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B85E9B9B-ADDB-4D2F-A857-685BD30CE856"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}