Home

CVE-2020-11934

Description

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

Risk Information

Base Score
5.9
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.045

Associated Vulnerability

VulnerabilityOS Platform
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1+18.04.2_i386.debLinux
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1+18.04.2_amd64.debLinux
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1+19.10.2_i386.debLinux
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1+19.10.2_amd64.debLinux
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1+20.04.2_amd64.debLinux
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1ubuntu0.2_i386.debLinux
Daemon and tooling that enable snap packages (USN-4424-1) snapd_2.45.1ubuntu0.2_amd64.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234