CVE-2020-27352 Privilege escalation in snapd
Attackers can gain unintended privileges in snapd-managed containers due to missing systemd delegation settings during unit reloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27352?
CVE-2020-27352 is a critical vulnerability in Canonical Ubuntu Linux, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.
Weakness: CWE-269
Which versions are affected by CVE-2020-27352?
It affects 2 products.
Products include Canonical Snapd, Canonical Ubuntu Linux.
How do I fix CVE-2020-27352?
Apply the vendor's patch.
Is CVE-2020-27352 being exploited?
There is no known exploitation of CVE-2020-27352 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2023-1523 Command injection in snapd
- CVE-2019-7304 Local privilege escalation via snapd socket
- CVE-2021-4120 snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths
- CVE-2024-5138 CVE-2024-5138: snapd snapctl auth bypass
- CVE-2022-3328 snapd Race Condition vulnerability
Sources
Also known as DEBIAN-CVE-2020-27352, GHSA-3hqj-7v65-62fj, UBUNTU-CVE-2020-27352, USN-4728-1.