When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: canonical
Published: 2024-06-21T20:06:37.992Z
Updated: 2024-08-04T16:11:36.612Z
Reserved: 2020-10-20T00:00:00.000Z
Link: CVE-2020-27352
Vulnrichment
Updated: 2024-08-04T16:11:36.612Z
NVD
Status : Awaiting Analysis
Published: 2024-06-21T20:15:10.630
Modified: 2024-07-11T15:05:04.077
Link: CVE-2020-27352
Redhat
No data.