Your submission was sent successfully! Close

CVE-2020-11934

Published: 15 July 2020

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

From the Ubuntu security team

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL. This issue did not affect Ubuntu Core systems. (CVE-2020-11934)

Notes

AuthorNote
emitorino
Since the vulnerability is present on the userd's OpenURL
implementation, it only affects classic distros where userd is
auto-started.
Since userd cannot be auto-started on Ubuntu Core 16, Ubuntu
Core 18 or Ubuntu Core 20 (for various reasons depending on the
release), then Ubuntu Core is not affected.
Even if userd happened to start (eg, the user started it
manually on UC20) there is no implicitOnCore policy that allows
communicating with io.snapcraft.Launcher (or the older
com.canonical.SafeLauncher).
The dbus interface can't be used (with either plugs or slots)
to communicate with userd.
/usr/bin/xdg-open on the boot file system of an Ubuntu Core
system is different to Classic: it is the sandbox proxy that calls back
into userd. Even if a session bus is running and a confined app could
call userd, userd will report an error because the caller is not confined
Priority

Medium

CVSS 3 base score: 7.6

Status

Package Release Status
snapd
Launchpad, Ubuntu, Debian
bionic
Released (2.45.1+18.04.2)
eoan
Released (2.45.1+19.10.2)
focal
Released (2.45.1+20.04.2)
precise Does not exist

trusty Does not exist

upstream
Released (2.45.2)
xenial
Released (2.45.1ubuntu0.2)
Patches:
upstream: https://github.com/snapcore/snapd/commit/06342a31878f1cf99d56da5483e71b9af61f46ad