CVE-2020-11933

Name of the Vulnerable Software and Affected Versions snapd versions prior to 2.45.2 Ubuntu Core versions prior to 2.45.2

Description A physical attacker could exploit this issue by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device, bypassing intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems.

Recommendations For snapd versions prior to 2.45.2, update to version 2.45.2 or later. For Ubuntu Core versions prior to 2.45.2, update to version 2.45.2 or later. As a temporary workaround, consider restricting access to external media to minimize the risk of exploitation.