CVE-2020-27348 - OpenCVE

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:M/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Canonical	Snapcraft Ubuntu Linux

Configuration 1 [-]

cpe:2.3:a:canonical:snapcraft:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:canonical:ubuntu_linux:16.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:18.04:::::::*

No data.

References

Link	Providers
https://bugs.launchpad.net/bugs/1901572
https://github.com/snapcore/snapcraft/pull/3345
https://usn.ubuntu.com/usn/usn-4661-1

History

No history.

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2020-12-04T02:30:36.159059Z

Updated: 2024-09-16T17:14:15.768Z

Reserved: 2020-10-20T00:00:00

Link: CVE-2020-27348

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-12-04T03:15:12.413

Modified: 2020-12-14T20:36:00.067

Link: CVE-2020-27348

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "snapcraft", "vendor": "Canonical", "versions": [{"lessThan": "4.4.4", "status": "affected", "version": "4.4", "versionType": "custom"}, {"changes": [{"at": "2.43.1+18.04.1", "status": "unaffected"}], "lessThan": "2.43.1+16.04.1", "status": "affected", "version": "2.43.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "itszn"}], "datePublic": "2020-12-03T00:00:00", "descriptions": [{"lang": "en", "value": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-04T02:30:36", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/snapcore/snapcraft/pull/3345"}, {"tags": ["x_refsource_MISC"], "url": "https://usn.ubuntu.com/usn/usn-4661-1"}, {"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/bugs/1901572"}], "source": {"advisory": "https://usn.ubuntu.com/usn/usn-4661-1", "defect": ["https://bugs.launchpad.net/bugs/1901572"], "discovery": "EXTERNAL"}, "title": "snapcraft may build snaps with incorrect LD_LIBRARY_PATH", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2020-12-03T18:16:00.000Z", "ID": "CVE-2020-27348", "STATE": "PUBLIC", "TITLE": "snapcraft may build snaps with incorrect LD_LIBRARY_PATH"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "snapcraft", "version": {"version_data": [{"version_affected": "<", "version_name": "4.4", "version_value": "4.4.4"}, {"version_affected": "<", "version_name": "2.43.1", "version_value": "2.43.1+16.04.1"}, {"version_affected": "<", "version_name": "2.43.1", "version_value": "2.43.1+18.04.1"}]}}]}, "vendor_name": "Canonical"}]}}, "credit": [{"lang": "eng", "value": "itszn"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-427 Uncontrolled Search Path Element"}]}]}, "references": {"reference_data": [{"name": "https://github.com/snapcore/snapcraft/pull/3345", "refsource": "MISC", "url": "https://github.com/snapcore/snapcraft/pull/3345"}, {"name": "https://usn.ubuntu.com/usn/usn-4661-1", "refsource": "MISC", "url": "https://usn.ubuntu.com/usn/usn-4661-1"}, {"name": "https://bugs.launchpad.net/bugs/1901572", "refsource": "MISC", "url": "https://bugs.launchpad.net/bugs/1901572"}]}, "source": {"advisory": "https://usn.ubuntu.com/usn/usn-4661-1", "defect": ["https://bugs.launchpad.net/bugs/1901572"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T16:11:36.588Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/snapcore/snapcraft/pull/3345"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://usn.ubuntu.com/usn/usn-4661-1"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/bugs/1901572"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2020-27348", "datePublished": "2020-12-04T02:30:36.159059Z", "dateReserved": "2020-10-20T00:00:00", "dateUpdated": "2024-09-16T17:14:15.768Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:snapcraft:*:*:*:*:*:*:*:*", "matchCriteriaId": "68DD1264-E95B-4BFB-8E25-EE5AB9090693", "versionEndExcluding": "4.4.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*", "matchCriteriaId": "712507AC-DAB8-4FFE-9426-08282919411F", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*", "matchCriteriaId": "B85E9B9B-ADDB-4D2F-A857-685BD30CE856", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1."}, {"lang": "es", "value": "En algunas condiciones, un paquete snap creado por snapcraft incluye el directorio actual en LD_LIBRARY_PATH, permitiendo a un snap malicioso conseguir una ejecuci\u00f3n de c\u00f3digo dentro del contexto de otro snap si ambos conectan la interfaz de inicio o similar. Este problema afecta a Snapcraft versiones anteriores a 4.4.4, anteriores a 2.43.1+16.04.1 y anteriores a 2.43.1+18.04.1"}], "id": "CVE-2020-27348", "lastModified": "2020-12-14T20:36:00.067", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.5, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2020-12-04T03:15:12.413", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/bugs/1901572"}, {"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://github.com/snapcore/snapcraft/pull/3345"}, {"source": "security@ubuntu.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://usn.ubuntu.com/usn/usn-4661-1"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "security@ubuntu.com", "type": "Secondary"}]}