CVE-2020-11934: Sandbox escape vulnerability via snapctl user-open (xdg-open)

Published Jul 29, 2020

Updated

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

Affected Software

4 affected components

Ubuntu=16.04

Ubuntu=18.04

Ubuntu=19.10

Ubuntu=20.04

Event History

Jul 29, 2020

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-11934?

CVE-2020-11934 has a medium severity rating due to the potential for unauthorized alteration of environment variables.

How do I fix CVE-2020-11934?

To mitigate CVE-2020-11934, users should update their Ubuntu system to the latest available patches for their version.

Which versions of Ubuntu are affected by CVE-2020-11934?

CVE-2020-11934 affects Ubuntu versions 16.04, 18.04, 19.10, and 20.04.

What type of vulnerability is CVE-2020-11934?

CVE-2020-11934 is classified as an exposure vulnerability that allows a malicious snap to modify environment variables.

Can CVE-2020-11934 be exploited remotely?

CVE-2020-11934 requires local access to the system, making it not directly exploitable remotely without prior access.