CVE-2024-5300

Name of the Vulnerable Software and Affected Versions Canonical snapd (affected versions not specified)

Description An access control bypass and information disclosure issue exists in the base AppArmor security profile configuration. Abstraction rules in /etc/apparmor.d/abstractions/nss-systemd allow strictly confined snap applications to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets located under /run/systemd/userdb/. When the systemd-userdbd service is operational, it does not distinguish between the host system's unconfined root user and a restricted root user within a snap sandbox. Consequently, a malicious snap executing as root can query the Varlink interface to retrieve complete user records, including sensitive hashed passwords from /etc/shadow, bypassing sandbox restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.