CVE-2024-5138

EUVD-2025-0101
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
canonicalsnapd
2.51.6 ≤
𝑥
< 2.63.1
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
canonicalsnapd
𝑥
< 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14
ADP
Debian logo
Debian Releases
Debian Product
Codename
snapd
bookworm
no-dsa
bullseye
no-dsa
bullseye (security)
vulnerable
buster
not-affected
forky
2.71-3
fixed
sid
2.71-3
fixed
trixie
2.68.3-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
snapd
bionic
needed
focal
needed
jammy
needed
mantic
ignored
noble
needed
oracular
not-affected
plucky
not-affected
questing
not-affected
xenial
needed
Common Weakness Enumeration
References
https://bugs.launchpad.net/snapd/+bug/2065077
https://github.com/snapcore/snapd/commit/68ee9c6aa916ab87dbfd9a26030690f2cabf1e14
https://github.com/snapcore/snapd/security/advisories/GHSA-p9v8-q5m4-pf46
https://www.cve.org/CVERecord?id=CVE-2024-5138
https://bugs.launchpad.net/snapd/+bug/2065077
https://github.com/snapcore/snapd/commit/68ee9c6aa916ab87dbfd9a26030690f2cabf1e14
https://github.com/snapcore/snapd/security/advisories/GHSA-p9v8-q5m4-pf46
https://www.cve.org/CVERecord?id=CVE-2024-5138