critical9.8Public exploit code
CVE-2019-7304
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)2019-02-13 · local · linux
- snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)2019-02-13 · local · linux
Impact
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Canonical | Snapd | before 2.37.1 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 18.04, 18.10 |