Privilege escalation in Snapd - CVE-2019-7304
Published: February 13, 2019 / Updated: July 29, 2021
Vulnerability identifier: #VU17656
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7304
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local attacker to gain elevated privileges.
The weakness exists due to a bug in the snapd API when validation and parsing the remote socket address while performing access controls on its UNIX socket. A local attacker can access privileged socket APIs and obtain administrator privileges.
Note: the vulnerability has been dubbed as 'Dirty Sock'.
The weakness exists due to a bug in the snapd API when validation and parsing the remote socket address while performing access controls on its UNIX socket. A local attacker can access privileged socket APIs and obtain administrator privileges.
Note: the vulnerability has been dubbed as 'Dirty Sock'.
Affected software
Snapd
snapd (Ubuntu package)
snapd (Ubuntu package)
How to mitigate CVE-2019-7304
Update to version 2.37.1.
Snapd - update to 2.37.1
snapd (Ubuntu package) - addressed in versions 2.34.2ubuntu0.1, 2.34.2~14.04.1, 2.34.2+18.04.1, 2.35.5+18.10.1
snapd (Ubuntu package) - addressed in versions 2.34.2ubuntu0.1, 2.34.2~14.04.1, 2.34.2+18.04.1, 2.35.5+18.10.1
Links to Public Exploits and PoC-codes
- Exploit #6574 - dirty_sock (Local Privilege Escalation via snapd (CVE-2019-7304) Remastered PoC exploit) (July 29, 2021)
- Exploit #5249 - snap_priv_esc (Another implementation for linux privilege escalation exploit via snap(d) (CVE-2019-7304)) (March 30, 2021)
- Exploit #2015 - dirty_sock (Linux privilege escalation exploit via snapd (CVE-2019-7304)) (March 18, 2020)