CVE-2017-14178 Security feature bypass in snapd
Unprivileged users can bypass systemd-journald access restrictions to read system logs via the snap logs command.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-14178?
CVE-2017-14178 is a high-severity vulnerability in snapd, published on 2 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
Weakness: CWE-755
Which versions are affected by CVE-2017-14178?
It affects 1 product.
Products include Snapcraft Snapd.
How do I fix CVE-2017-14178?
Upgrade to a fixed version.
Is CVE-2017-14178 being exploited?
There is no known exploitation of CVE-2017-14178 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2017-14178, UBUNTU-CVE-2017-14178.