CVE-2019-7303 — Snapd seccomp filter TIOCSTI ioctl bypass

Affected: Canonical snapd

A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.

USN-3917-1 — snapd vulnerability

Affected: Ubuntu:14.04:LTS: snapd, Ubuntu:16.04:LTS: snapd, Ubuntu:18.04:LTS: snapd

The snapd default seccomp filter for strict mode snaps blocks the use of the ioctl() system call when used with TIOCSTI as the second argument to the system call. Jann Horn discovered that this restriction could be circumvented on 64 bit architectures. A malicious snap could exploit this to bypass intended access restrictions to insert characters into the terminal's input queue. On Ubuntu, snapd typically will have already automatically refreshed itself to snapd 2.37.4 which is unaffected.

Most recent entries from all

CVE-2019-7303 — Snapd seccomp filter TIOCSTI ioctl bypass

USN-3917-1 — snapd vulnerability