CVE-2020-27352

Critical

Description

When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.

SeverityCritical

CVSS9.3

Exploit probability—

ProductCanonical Snapd

PublishedJun 21, 2024

First seenJun 21, 2024

Weakness typeCWE-269Improper privilege management

How to fix

Update

canonical snapd2.48.3 or later

Vendor advisories

ubuntu.com/security/notices/USN-4728-1

Affected products

Product	Affected versions	Fixed in
canonical snapd	v < 2.48.3	2.48.3
canonical ubuntu_linux	16.04, 18.04, 20.04, 20.10	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.