Vulnerability-Lookup

ubuntu-cve-2024-5300

Vulnerability from osv_ubuntu

Published

2026-07-21 14:00

Modified

2026-07-21 20:49

Summary

Details

On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.

Severity

5.6 (Medium)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-5300	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-5300	REPORT
	https://ubuntu.com/security/notices/USN-8579-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.61.4ubuntu0.16.04.1+esm4?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.61.4ubuntu0.16.04.1+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9",
        "1.9.1.1",
        "1.9.2",
        "2.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.5",
        "2.0.8",
        "2.0.9",
        "2.0.10",
        "2.11+0.16.04",
        "2.12+0.16.04",
        "2.13",
        "2.14.2~16.04",
        "2.15.2ubuntu1",
        "2.16ubuntu3",
        "2.17.1ubuntu1",
        "2.20.1ubuntu1",
        "2.21",
        "2.22.2",
        "2.22.3",
        "2.22.6",
        "2.23.1",
        "2.24.1",
        "2.25",
        "2.26.10",
        "2.27.5",
        "2.28.5",
        "2.29.4.2",
        "2.32.3.2",
        "2.32.9",
        "2.33.1ubuntu2",
        "2.34.2",
        "2.34.2ubuntu0.1",
        "2.37.4",
        "2.37.4ubuntu0.1",
        "2.38",
        "2.39.2",
        "2.39.2ubuntu0.2",
        "2.40",
        "2.42.1",
        "2.45.1",
        "2.45.1ubuntu0.2",
        "2.46.1",
        "2.47.1",
        "2.48",
        "2.48.3",
        "2.54.3+16.04~esm2",
        "2.54.3+16.04.0ubuntu0.1~esm3",
        "2.54.3+16.04.0ubuntu0.1~esm4",
        "2.54.3+16.04.0ubuntu0.1~esm5",
        "2.54.3+16.04.0ubuntu0.1~esm6",
        "2.61.4ubuntu0.16.04.1+esm1",
        "2.61.4ubuntu0.16.04.1+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.61.4ubuntu0.18.04.1+esm4?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.61.4ubuntu0.18.04.1+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.28.5+17.10",
        "2.29.4.1+18.04",
        "2.29.4.2+18.04",
        "2.31.1+18.04",
        "2.32+18.04~pre5",
        "2.32+18.04~pre6",
        "2.32+18.04",
        "2.32.3.2+18.04",
        "2.32.5+18.04",
        "2.32.8+18.04",
        "2.32.9+18.04",
        "2.33.1+18.04ubuntu2",
        "2.34.2+18.04",
        "2.34.2+18.04.1",
        "2.37.1+18.04",
        "2.37.1.1+18.04",
        "2.37.4+18.04",
        "2.37.4+18.04.1",
        "2.38+18.04",
        "2.39.2+18.04",
        "2.40+18.04",
        "2.42.1+18.04",
        "2.45.1+18.04",
        "2.45.1+18.04.2",
        "2.46.1+18.04",
        "2.47.1+18.04",
        "2.48+18.04",
        "2.48.3+18.04",
        "2.49.2+18.04",
        "2.51.1+18.04",
        "2.54.2+18.04ubuntu1",
        "2.54.3+18.04",
        "2.54.3+18.04.2ubuntu0.1",
        "2.54.3+18.04.2ubuntu0.2",
        "2.55.5+18.04",
        "2.57.5+18.04",
        "2.57.5+18.04ubuntu0.1",
        "2.58+18.04",
        "2.58+18.04.1",
        "2.61.4ubuntu0.18.04.1+esm1",
        "2.61.4ubuntu0.18.04.1+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.67.1+20.04ubuntu1~esm3?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.67.1+20.04ubuntu1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.41+19.10.1",
        "2.42.1+20.04",
        "2.43.3+git1.8109f8",
        "2.44~pre1+20.04",
        "2.44+20.04",
        "2.44.2+20.04",
        "2.44.3+20.04",
        "2.45.1+20.04",
        "2.45.1+20.04.2",
        "2.46.1+20.04",
        "2.47.1+20.04",
        "2.48+20.04",
        "2.48.3+20.04",
        "2.49.2+20.04",
        "2.51.1+20.04ubuntu2",
        "2.54.2+20.04ubuntu2",
        "2.54.3+20.04",
        "2.54.3+20.04.1",
        "2.54.3+20.04.1ubuntu0.1",
        "2.54.3+20.04.1ubuntu0.2",
        "2.54.3+20.04.1ubuntu0.3",
        "2.55.5+20.04",
        "2.57.5+20.04",
        "2.57.5+20.04ubuntu0.1",
        "2.58+20.04",
        "2.58+20.04.1",
        "2.61.3+20.04",
        "2.62+20.04",
        "2.63+20.04",
        "2.63+20.04ubuntu0.1",
        "2.65.3+20.04",
        "2.66.1+20.04",
        "2.67.1+20.04",
        "2.67.1+20.04ubuntu1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.76+ubuntu22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.76+ubuntu22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.76+ubuntu22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.53+21.10ubuntu1",
        "2.54.2+22.04ubuntu1",
        "2.54.2+22.04ubuntu2",
        "2.54.2+22.04ubuntu3",
        "2.54.3+git19.g868fc21+22.04",
        "2.54.3+git26.g360067e+22.04",
        "2.55.2+22.04",
        "2.55.2+22.04.1",
        "2.55.3+22.04",
        "2.55.3+22.04ubuntu1",
        "2.55.5+22.04",
        "2.56.2+22.04ubuntu1",
        "2.57.4+22.04",
        "2.57.5+22.04",
        "2.57.5+22.04ubuntu0.1",
        "2.58+22.04",
        "2.58+22.04.1",
        "2.61.3+22.04",
        "2.62+22.04",
        "2.63+22.04",
        "2.63+22.04ubuntu0.1",
        "2.65.3+22.04",
        "2.66.1+22.04",
        "2.67.1+22.04",
        "2.68.5+ubuntu22.04.1",
        "2.71+ubuntu22.04",
        "2.72+ubuntu22.04",
        "2.73+ubuntu22.04",
        "2.73+ubuntu22.04.1",
        "2.74.1+ubuntu22.04.4",
        "2.75.2+ubuntu22.04",
        "2.76+ubuntu22.04"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.76+ubuntu24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.76+ubuntu24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.76+ubuntu24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.60.4+23.10",
        "2.61.3+24.04",
        "2.62+24.04build1",
        "2.63+24.04",
        "2.63+24.04ubuntu0.1",
        "2.63.1+24.04",
        "2.65.3+24.04",
        "2.66.1+24.04",
        "2.67.1+24.04",
        "2.68.5+ubuntu24.04.1",
        "2.71+ubuntu24.04",
        "2.72+ubuntu24.04",
        "2.73+ubuntu24.04",
        "2.73+ubuntu24.04.1",
        "2.73+ubuntu24.04.2",
        "2.74.1+ubuntu24.04.4",
        "2.75.2+ubuntu24.04",
        "2.76+ubuntu24.04"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.75.2+ubuntu25.10"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.75.2+ubuntu25.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.75.2+ubuntu25.10?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.67.1+25.04",
        "2.68.5+ubuntu25.10.2",
        "2.71+ubuntu25.10",
        "2.71.1+ubuntu25.10.1",
        "2.72+ubuntu25.10.2",
        "2.73+ubuntu25.10",
        "2.73+ubuntu25.10.1",
        "2.74.1+ubuntu25.10.4",
        "2.75.2+ubuntu25.10"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.76+ubuntu26.04.3"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.76+ubuntu26.04.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.76+ubuntu26.04.3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.76+ubuntu26.04.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.71.1+ubuntu25.10.1",
        "2.72+ubuntu26.04.1",
        "2.73+ubuntu26.04.1",
        "2.74+ubuntu26.04",
        "2.74.1+ubuntu26.04",
        "2.74.1+ubuntu26.04.3",
        "2.74.1+ubuntu26.04.4",
        "2.75.2+ubuntu26.04.2",
        "2.76+ubuntu26.04.2"
      ]
    }
  ],
  "aliases": [],
  "details": "On Ubuntu, if the systemd-userdbd package is installed, then a strictly confined snap is able to access hashed user passwords via its varlink interface.",
  "id": "UBUNTU-CVE-2024-5300",
  "modified": "2026-07-21T20:49:57Z",
  "published": "2026-07-21T14:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-5300"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5300"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8579-1"
    }
  ],
  "related": [
    "USN-8579-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-5300"
  ]
}

CVE-2024-5300 (GCVE-0-2024-5300)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:00 – Updated: 2026-07-22 18:28

Title

AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd

Summary

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-212 - Improper removal of sensitive information before storage or transfer

Assigner

canonical

References

1 reference

URL	Tags
https://ubuntu.com/security/CVE-2024-5300	vdb-entryissue-tracking

Impacted products

7 products

Vendor	Product	Version
		Affected: 0 , < 2.76.1 (semver)
Canonical	Ubuntu 26.04 LTS	Unaffected: 2.76+ubuntu26.04.3 (dpkg)
Canonical	Ubuntu 24.04 LTS	Unaffected: 2.76+ubuntu24.04.1 (dpkg)
Canonical	Ubuntu 22.04 LTS	Unaffected: 2.76+ubuntu22.04.1 (dpkg)
Canonical	Ubuntu 20.04 LTS	Unaffected: 2.67.1+20.04ubuntu1~esm2 (dpkg)
Canonical	Ubuntu 18.04 LTS	Unaffected: 2.61.4ubuntu0.18.04.1+esm3 (dpkg)
Canonical	Ubuntu 16.04 LTS	Unaffected: 2.61.4ubuntu0.16.04.1+esm3

Date Public

2026-07-21 14:00

Credits

James Henstridge

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-5300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:13:29.966474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:28:16.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/canonical",
          "defaultStatus": "unaffected",
          "packageName": "snapd",
          "repo": "https://github.com/canonical/snapd/",
          "versions": [
            {
              "lessThan": "2.76.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/resolute",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 26.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu26.04.3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/noble",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 24.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu24.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/jammy",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 22.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.76+ubuntu22.04.1",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/focal",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 20.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.67.1+20.04ubuntu1~esm2",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/bionic",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 18.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.18.04.1+esm3",
              "versionType": "dpkg"
            }
          ]
        },
        {
          "collectionURL": "https://launchpad.net/ubuntu/xenial",
          "defaultStatus": "affected",
          "packageName": "snapd",
          "platforms": [
            "Linux"
          ],
          "product": "Ubuntu 16.04 LTS",
          "repo": "https://launchpad.net/ubuntu/+source/snapd",
          "vendor": "Canonical",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.61.4ubuntu0.16.04.1+esm3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "James Henstridge"
        }
      ],
      "datePublic": "2026-07-21T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/.\nOn systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application\u0027s sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records\u2014including sensitive hashed user passwords from /etc/shadow\u2014when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212 Improper removal of sensitive information before storage or transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T14:00:51.066Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "issue-tracking"
          ],
          "url": "https://ubuntu.com/security/CVE-2024-5300"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2024-5300",
    "datePublished": "2026-07-21T14:00:51.066Z",
    "dateReserved": "2024-05-23T21:58:22.809Z",
    "dateUpdated": "2026-07-22T18:28:16.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-8579-1

Vulnerability from osv_ubuntu

Published

2026-07-21 14:24

Modified

2026-07-21 14:24

Summary

snapd vulnerabilities

Details

James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2024-5300)

Qualys discovered that snap-confine can be tricked to create attacker-controlled files at certain privileged locations. A local attacker could possibly use this issue to bypass intended restrictions and escalate privileges to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8933)

Zygmunt Krynicki discovered that snapd's default seccomp template did not restrict the creation of executables with the set-user-ID attribute. A local attacker could possibly use this issue to create and execute setuid binaries. (CVE-2026-15226)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8579-1	ADVISORY
	https://ubuntu.com/security/CVE-2024-5300	REPORT
	https://ubuntu.com/security/CVE-2026-8933	REPORT
	https://ubuntu.com/security/CVE-2026-15226	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-5300",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-15226",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.61.4ubuntu0.16.04.1+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.61.4ubuntu0.16.04.1+esm4?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.61.4ubuntu0.16.04.1+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9",
        "1.9.1.1",
        "1.9.2",
        "2.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.5",
        "2.0.8",
        "2.0.9",
        "2.0.10",
        "2.11+0.16.04",
        "2.12+0.16.04",
        "2.13",
        "2.14.2~16.04",
        "2.15.2ubuntu1",
        "2.16ubuntu3",
        "2.17.1ubuntu1",
        "2.20.1ubuntu1",
        "2.21",
        "2.22.2",
        "2.22.3",
        "2.22.6",
        "2.23.1",
        "2.24.1",
        "2.25",
        "2.26.10",
        "2.27.5",
        "2.28.5",
        "2.29.4.2",
        "2.32.3.2",
        "2.32.9",
        "2.33.1ubuntu2",
        "2.34.2",
        "2.34.2ubuntu0.1",
        "2.37.4",
        "2.37.4ubuntu0.1",
        "2.38",
        "2.39.2",
        "2.39.2ubuntu0.2",
        "2.40",
        "2.42.1",
        "2.45.1",
        "2.45.1ubuntu0.2",
        "2.46.1",
        "2.47.1",
        "2.48",
        "2.48.3",
        "2.54.3+16.04~esm2",
        "2.54.3+16.04.0ubuntu0.1~esm3",
        "2.54.3+16.04.0ubuntu0.1~esm4",
        "2.54.3+16.04.0ubuntu0.1~esm5",
        "2.54.3+16.04.0ubuntu0.1~esm6",
        "2.61.4ubuntu0.16.04.1+esm1",
        "2.61.4ubuntu0.16.04.1+esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-5300",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-15226",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.61.4ubuntu0.18.04.1+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.61.4ubuntu0.18.04.1+esm4?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.61.4ubuntu0.18.04.1+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.28.5+17.10",
        "2.29.4.1+18.04",
        "2.29.4.2+18.04",
        "2.31.1+18.04",
        "2.32+18.04~pre5",
        "2.32+18.04~pre6",
        "2.32+18.04",
        "2.32.3.2+18.04",
        "2.32.5+18.04",
        "2.32.8+18.04",
        "2.32.9+18.04",
        "2.33.1+18.04ubuntu2",
        "2.34.2+18.04",
        "2.34.2+18.04.1",
        "2.37.1+18.04",
        "2.37.1.1+18.04",
        "2.37.4+18.04",
        "2.37.4+18.04.1",
        "2.38+18.04",
        "2.39.2+18.04",
        "2.40+18.04",
        "2.42.1+18.04",
        "2.45.1+18.04",
        "2.45.1+18.04.2",
        "2.46.1+18.04",
        "2.47.1+18.04",
        "2.48+18.04",
        "2.48.3+18.04",
        "2.49.2+18.04",
        "2.51.1+18.04",
        "2.54.2+18.04ubuntu1",
        "2.54.3+18.04",
        "2.54.3+18.04.2ubuntu0.1",
        "2.54.3+18.04.2ubuntu0.2",
        "2.55.5+18.04",
        "2.57.5+18.04",
        "2.57.5+18.04ubuntu0.1",
        "2.58+18.04",
        "2.58+18.04.1",
        "2.61.4ubuntu0.18.04.1+esm1",
        "2.61.4ubuntu0.18.04.1+esm2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-5300",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-15226",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.67.1+20.04ubuntu1~esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.67.1+20.04ubuntu1~esm3?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.67.1+20.04ubuntu1~esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.41+19.10.1",
        "2.42.1+20.04",
        "2.43.3+git1.8109f8",
        "2.44~pre1+20.04",
        "2.44+20.04",
        "2.44.2+20.04",
        "2.44.3+20.04",
        "2.45.1+20.04",
        "2.45.1+20.04.2",
        "2.46.1+20.04",
        "2.47.1+20.04",
        "2.48+20.04",
        "2.48.3+20.04",
        "2.49.2+20.04",
        "2.51.1+20.04ubuntu2",
        "2.54.2+20.04ubuntu2",
        "2.54.3+20.04",
        "2.54.3+20.04.1",
        "2.54.3+20.04.1ubuntu0.1",
        "2.54.3+20.04.1ubuntu0.2",
        "2.54.3+20.04.1ubuntu0.3",
        "2.55.5+20.04",
        "2.57.5+20.04",
        "2.57.5+20.04ubuntu0.1",
        "2.58+20.04",
        "2.58+20.04.1",
        "2.61.3+20.04",
        "2.62+20.04",
        "2.63+20.04",
        "2.63+20.04ubuntu0.1",
        "2.65.3+20.04",
        "2.66.1+20.04",
        "2.67.1+20.04",
        "2.67.1+20.04ubuntu1~esm1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-5300",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8933",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-15226",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.76+ubuntu22.04.1"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.76+ubuntu22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.76+ubuntu22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.76+ubuntu22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.53+21.10ubuntu1",
        "2.54.2+22.04ubuntu1",
        "2.54.2+22.04ubuntu2",
        "2.54.2+22.04ubuntu3",
        "2.54.3+git19.g868fc21+22.04",
        "2.54.3+git26.g360067e+22.04",
        "2.55.2+22.04",
        "2.55.2+22.04.1",
        "2.55.3+22.04",
        "2.55.3+22.04ubuntu1",
        "2.55.5+22.04",
        "2.56.2+22.04ubuntu1",
        "2.57.4+22.04",
        "2.57.5+22.04",
        "2.57.5+22.04ubuntu0.1",
        "2.58+22.04",
        "2.58+22.04.1",
        "2.61.3+22.04",
        "2.62+22.04",
        "2.63+22.04",
        "2.63+22.04ubuntu0.1",
        "2.65.3+22.04",
        "2.66.1+22.04",
        "2.67.1+22.04",
        "2.68.5+ubuntu22.04.1",
        "2.71+ubuntu22.04",
        "2.72+ubuntu22.04",
        "2.73+ubuntu22.04",
        "2.73+ubuntu22.04.1",
        "2.74.1+ubuntu22.04.4",
        "2.75.2+ubuntu22.04",
        "2.76+ubuntu22.04"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-5300",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8933",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-15226",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "snap-confine",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.76+ubuntu24.04.1"
          },
          {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.76+ubuntu24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.76+ubuntu24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.76+ubuntu24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.60.4+23.10",
        "2.61.3+24.04",
        "2.62+24.04build1",
        "2.63+24.04",
        "2.63+24.04ubuntu0.1",
        "2.63.1+24.04",
        "2.65.3+24.04",
        "2.66.1+24.04",
        "2.67.1+24.04",
        "2.68.5+ubuntu24.04.1",
        "2.71+ubuntu24.04",
        "2.72+ubuntu24.04",
        "2.73+ubuntu24.04",
        "2.73+ubuntu24.04.1",
        "2.73+ubuntu24.04.2",
        "2.74.1+ubuntu24.04.4",
        "2.75.2+ubuntu24.04",
        "2.76+ubuntu24.04"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-5300",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8933",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-15226",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.76+ubuntu26.04.3"
          },
          {
            "binary_name": "snapd",
            "binary_version": "2.76+ubuntu26.04.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "snapd",
        "purl": "pkg:deb/ubuntu/snapd@2.76+ubuntu26.04.3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.76+ubuntu26.04.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.71.1+ubuntu25.10.1",
        "2.72+ubuntu26.04.1",
        "2.73+ubuntu26.04.1",
        "2.74+ubuntu26.04",
        "2.74.1+ubuntu26.04",
        "2.74.1+ubuntu26.04.3",
        "2.74.1+ubuntu26.04.4",
        "2.75.2+ubuntu26.04.2",
        "2.76+ubuntu26.04.2"
      ]
    }
  ],
  "aliases": [],
  "details": "James Henstridge discovered that snapd\u0027s default apparmor template did\nnot restrict access to systemd-userdbd varlink interface. A local\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2024-5300)\n\nQualys discovered that snap-confine can be tricked to create\nattacker-controlled files at certain privileged locations. A local\nattacker could possibly use this issue to bypass intended restrictions\nand escalate privileges to root. This issue only affected\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-8933)\n\nZygmunt Krynicki discovered that snapd\u0027s default seccomp template\ndid not restrict the creation of executables with the set-user-ID\nattribute. A local attacker could possibly use this issue to create\nand execute setuid binaries. (CVE-2026-15226)",
  "id": "USN-8579-1",
  "modified": "2026-07-21T14:24:27Z",
  "published": "2026-07-21T14:24:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8579-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-5300"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8933"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-15226"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "snapd vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2024-5300",
    "UBUNTU-CVE-2026-8933",
    "UBUNTU-CVE-2026-15226"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

ubuntu-cve-2024-5300

Vulnerability from osv_ubuntu

CVE-2024-5300 (GCVE-0-2024-5300)

usn-8579-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature