CVE-2020-27348 : In some conditions, a snap package built by snapcraft includes the current direc

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.

Published 2020-12-04 03:15:12

Updated 2020-12-14 20:36:00

Source Canonical Ltd.

View at NVD, CVE.org

Products affected by CVE-2020-27348

Canonical » Ubuntu Linux » Version: 18.04
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*
Matching versions
Canonical » Snapcraft
Versions before (<) 4.4.4
cpe:2.3:a:canonical:snapcraft:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-27348

Top countries where our scanners detected CVE-2020-27348

Top open port discovered on systems with this issue 80

IPs affected by CVE-2020-27348 13,362

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-27348!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-27348

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 36 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-27348

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.4	MEDIUM	AV:L/AC:M/Au:N/C:P/I:P/A:P	3.4	6.4	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.8	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L	1.3	5.5	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: Low
6.8	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L	1.3	5.5	Canonical Ltd.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: Low

CWE ids for CVE-2020-27348

CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Assigned by:
- nvd@nist.gov (Primary)
- security@ubuntu.com (Secondary)

References for CVE-2020-27348

https://bugs.launchpad.net/bugs/1901572

Bug #1901572 “snapd vulnerable to Library Injection from CWD” : Bugs : Snapcraft
Exploit;Issue Tracking;Third Party Advisory
https://github.com/snapcore/snapcraft/pull/3345

project_loader, formatting_utils: take empty env values into account by sergiusens · Pull Request #3345 · snapcore/snapcraft · GitHub
Third Party Advisory
https://usn.ubuntu.com/usn/usn-4661-1

USN-4661-1: Snapcraft vulnerability | Ubuntu security notices | Ubuntu
Patch;Third Party Advisory