Symbolic Link Vulnerability in snapd Package: Risk of Information Disclosure
Summary
DEBIAN-CVE-2024-29069: In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. Affects snapd versions < 2.62-1. Fixed in 2.62-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The snapd package is a core component of the Snap ecosystem, enabling the installation and management of snap packages on Debian-based systems. Snap packages are self-contained applications that include all necessary dependencies, allowing for easy deployment and isolation. However, prior to version 2.62, snapd exhibited a critical vulnerability related to the handling of symbolic links during the extraction of snap packages, which could lead to unauthorized access to sensitive information.
Vulnerability Detail
In snapd versions prior to 2.62, the software failed to properly validate the destination of symbolic links when extracting snap packages. This oversight allowed an attacker to craft a malicious snap containing symbolic links that, when installed, could redirect the extraction process to write sensitive information into world-readable directories. Consequently, unprivileged users could gain access to privileged data, posing a significant security risk.
How To Fix
Minimum fixed version
2.62-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade snapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid installing untrusted snap packages until they have updated to the patched version. Additionally, users should verify the integrity and source of snap packages before installation to mitigate potential risks.
Conclusion
The vulnerability in snapd poses a serious risk of information disclosure through the mishandling of symbolic links. Users are strongly encouraged to update to version 2.62-1 or later to mitigate this risk. By staying informed and utilizing tools like Vulert, users can better protect their systems from open-source vulnerabilities.
See every vulnerability recorded for snapd →
FAQ
The vulnerability allows unprivileged users to access sensitive information by exploiting symbolic links in malicious snap packages.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without any signup.
snapd versions prior to 2.62 are affected by this vulnerability.
Yes, avoid installing untrusted snap packages and verify the integrity of packages before installation.
If immediate updating is not possible, refrain from installing any new snap packages until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for snapd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
