- Vulnerability/
- USN-3917-1
USN-3917-1: snapd vulnerability
First published: Thu Mar 21 2019(Updated: )
The snapd default seccomp filter for strict mode snaps blocks the use of the ioctl() system call when used with TIOCSTI as the second argument to the system call. Jann Horn discovered that this restriction could be circumvented on 64 bit architectures. A malicious snap could exploit this to bypass intended access restrictions to insert characters into the terminal's input queue. On Ubuntu, snapd typically will have already automatically refreshed itself to snapd 2.37.4 which is unaffected.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/snapd | <2.37.4+18.10.1 | 2.37.4+18.10.1 |
| Ubuntu OpenSSH Client | =18.10 | |
| All of | ||
| ubuntu/snapd | <2.37.4+18.04.1 | 2.37.4+18.04.1 |
| Ubuntu OpenSSH Client | =18.04 | |
| All of | ||
| ubuntu/snapd | <2.37.4ubuntu0.1 | 2.37.4ubuntu0.1 |
| Ubuntu OpenSSH Client | =16.04 | |
| All of | ||
| ubuntu/snapd | <2.37.4~14.04.1 | 2.37.4~14.04.1 |
| Ubuntu OpenSSH Client | =14.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2019-7303
- https://launchpad.net/bugs/1812973
- https://launchpad.net/ubuntu/+source/snapd/2.37.4+18.10.1
- https://launchpad.net/ubuntu/+source/snapd/2.37.4+18.04.1
- https://launchpad.net/ubuntu/+source/snapd/2.37.4ubuntu0.1
- https://launchpad.net/ubuntu/+source/snapd/2.37.4~14.04.1
- https://ubuntu.com/security/notices/USN-3917-1 (Advisory)
Frequently Asked Questions
What is the severity of USN-3917-1?
The vulnerability identified as USN-3917-1 is categorized as a medium severity issue.
What versions of snapd are affected as per USN-3917-1?
USN-3917-1 affects snapd versions up to 2.37.4+18.10.1, 2.37.4+18.04.1, 2.37.4ubuntu0.1, and 2.37.4~14.04.1 on various Ubuntu releases.
How do I fix USN-3917-1?
To remediate the vulnerability USN-3917-1, upgrade snapd to the latest versions specified for your Ubuntu release.
What does USN-3917-1 impact in Ubuntu?
USN-3917-1 impacts the use of the ioctl() system call in strict mode snaps within the snapd environment.
Who discovered the vulnerability associated with USN-3917-1?
The vulnerability tied to USN-3917-1 was discovered by researcher Jann Horn.
- agent/title
- agent/severity
- agent/references
- agent/last-modified-date
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu openssh client
- version/ubuntu openssh client/18.10
- version/ubuntu openssh client/18.04
- version/ubuntu openssh client/16.04
- version/ubuntu openssh client/14.04