CVE-2019-7303

Publication date 21 March 2019

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.

Read the notes from the security team

Status

Package Ubuntu Release Status
snapd 18.10 cosmic
Fixed 2.37.4+18.10
18.04 LTS bionic
Fixed 2.37.4+18.04
16.04 LTS xenial
Fixed 2.37.4
14.04 LTS trusty
Fixed 2.37.4~14.04

Notes

jdstrand

this is a kernel limitation that is documented in the seccomp man page, but arguably the kernel should perform the seccomp filter check on the value that it is ultimately going to process (which likely means an improvement to libseccomp to generate the appropriate BPF to do this) this was further complicated by the fact that the kernel and glibc disagree on the function prototype of ioctl, where the glibc man page documents it as unsigned long and the kernel treats it as int (note, the tty_ioctl man page (which is the one that documents TIOCSTI) lists the ioctl second argument as an int) due to miscoordination, 2.37.4 is going to -updates first as part of the regular SRU cycle. Once that passes, we'll rebuild and publish to the security pocket and issue a USN. once this issue is public, the global profile initialization code that is used to address this issue will also be made public

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
snapd

Severity score breakdown

Parameter Value
Base score 7.5 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact High
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

Other references