CVE-2019-7304

Published: Apr 23, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.

Affected (5)

Products: Canonical: Snapd, Ubuntu Linux

Canonical

2 products

Snapd

Ubuntu Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Snapd	Before 2.37.1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://usn.ubuntu.com/3887-1/

Source: security@ubuntu.com

Vendor Advisory

https://www.exploit-db.com/exploits/46361

Source: security@ubuntu.com

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46362

Source: security@ubuntu.com

ExploitThird Party AdvisoryVDB Entry

https://usn.ubuntu.com/3887-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.exploit-db.com/exploits/46361

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/46362

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.