CVE-2024-1724 snapd allows $HOME/bin symlink

What is CVE-2024-1724?

CVE-2024-1724 is a medium-severity path traversal vulnerability in Canonical snap, published on 25 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.

Weakness: CWE-732

Which versions are affected by CVE-2024-1724?

3 open source packages ship an affected version, including github.com/snapcore/snapd. It affects 1 product.

Products include Canonical Snapd.

How do I fix CVE-2024-1724?

Upgrade github.com/snapcore/snapd to 2.62 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-1724 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1724 exists.

Other vulnerabilities in Canonical snap

• CVE-2023-1523 Command injection in snapd Critical 10.0
• CVE-2020-27352 Privilege escalation in snapd Critical 9.3
• CVE-2019-7304 Local privilege escalation via snapd socket High 8.8
• CVE-2021-4120 snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths High 8.2
• CVE-2024-5138 CVE-2024-5138: snapd snapctl auth bypass High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-1724, GHSA-4mh8-9689-38vr, GO-2024-3007, UBUNTU-CVE-2024-1724.