Published: 23/04/2019 Updated: 16/10/2020
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions before 2.37.4.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

canonical snapd

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 18.04

canonical ubuntu linux 18.10

Vendor Advisories

An intended access restriction in snapd could be bypassed by strict mode snaps on 64 bit architectures ...
Debian Bug report logs - #925541 CVE-2019-10063: incomplete TIOCSTI filtering, similar to snapd's CVE-2019-7303 Package: flatpak; Maintainer for flatpak is Utopia Maintenance Team <pkg-utopia-maintainers@listsaliothdebianorg>; Source for flatpak is src:flatpak (PTS, buildd, popcon) Reported by: Simon McVittie <smcv@deb ...


/* snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the source code, this filter is expressed as follows: # TIOCSTI allows for faking input (man tty_ioctl) # TODO: this should be scaled back even more ioctl - !TIOCSTI In the X86-64 version of the compiled seccomp filter, this results in the following BPF bytecode: [ ...
snap uses a seccomp filter with a blacklist for TIOCSTI can be circumvented ...