CVE-2020-27348 snapcraft may build snaps with incorrect LD_LIBRARY_PATH
Snapcraft may build snaps with unsafe LD_LIBRARY_PATH, allowing malicious snaps to execute code in other snaps sharing interfaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-27348?
CVE-2020-27348 is a medium-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 4 Dec 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
Weakness: CWE-427
Which versions are affected by CVE-2020-27348?
3 open source packages ship an affected version, including snapcraft. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
snapcraft PyPI | All versions | 2.43.1 |
snapcraft PyPI | All versions | 4.4.4 |
snapcraft PyPI | All versions | 4.4.4 |
Products include Canonical Snapcraft, Canonical Ubuntu Linux.
How do I fix CVE-2020-27348?
Upgrade snapcraft to a fixed version for your release line: 2.43.1 or 4.4.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-27348 being exploited?
There is no known exploitation of CVE-2020-27348 in the wild and no public exploit code.
Sources
Also known as GHSA-qxm5-vx5j-pp6w, PYSEC-2020-109, UBUNTU-CVE-2020-27348, USN-4661-1.