USN-3887-1: snapd vulnerability
Severity
High
Vendor
Canonical Ubuntu
Versions Affected
- Canonical Ubuntu 14.04
- Canonical Ubuntu 16.04
- Canonical Ubuntu 18.04
Description
Chris Moberly discovered that snapd versions 2.28 through 2.37 incorrectly validated and parsed the remote socket address when performing access controls on its UNIX socket. A local attacker could use this to access privileged socket APIs and obtain administrator privileges. On Ubuntu systems with snaps installed, snapd typically will have already automatically refreshed itself to snapd 2.37.1 which is unaffected.
Affected Cloud Foundry Products and Versions
Current versions of trusty stemcells, xenial stemcells, cflinuxfs2 and cflinuxfs3 are not affected by this vulnerability.
