CVE-2019-7303

moderate-risk
Published 2019-04-23

A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.

Do I need to act?

~
1.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
46594
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (5)

Snapd

Affected Vendors

Canonical

References (4)

Third Party Advisory https://usn.ubuntu.com/3917-1/
Exploit https://www.exploit-db.com/exploits/46594
Third Party Advisory https://usn.ubuntu.com/3917-1/
Exploit https://www.exploit-db.com/exploits/46594
48
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 10/34 · Low
Exposure 12/34 · Low