Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/snapcore/snapd: CVE-2024-1724 #3007

Closed
GoVulnBot opened this issue Jul 25, 2024 · 1 comment
Assignees
Labels

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-1724 references a vulnerability in the following Go modules:

Module
github.com/snapcore/snapd

Description:
In snapd versions prior to 2.62, when using AppArmor for enforcement of
sandbox permissions, snapd failed to restrict writes to the $HOME/bin
path. In Ubuntu, when this path exists, it is automatically added to
the users PATH. An attacker who could convince a user to install a
malicious snap which used the 'home' plug could use this vulnerability
to install arbitrary scripts into the users PATH which may then be run
by the user outside of the expected snap sandbox and hence allow them
to escape confinement.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/snapcore/snapd
      vulnerable_at: 0.0.0-20240725195426-a8d817ac41d4
summary: CVE-2024-1724 in github.com/snapcore/snapd
cves:
    - CVE-2024-1724
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-1724
    - fix: https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6
    - fix: https://github.com/snapcore/snapd/pull/13689
    - web: https://gld.mcphail.uk/posts/explaining-cve-2024-1724/
source:
    id: CVE-2024-1724
    created: 2024-07-25T21:01:16.595163527Z
review_status: UNREVIEWED

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants