CVE-2023-1523
Published: 25 May 2023
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
From the Ubuntu Security Team
It was discovered that the snap sandbox did not restrict the use of the ioctl system call with a TIOCLINUX request. This could be exploited by a malicious snap to inject commands into the controlling terminal which would then be executed outside of the snap sandbox once the snap had exited. This could allow an attacker to execute arbitrary commands outside of the confined snap sandbox. Note: graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
snapd Launchpad, Ubuntu, Debian |
bionic |
Released
(2.58+18.04.1)
|
| focal |
Released
(2.58+20.04.1)
|
|
| jammy |
Released
(2.58+22.04.1)
|
|
| kinetic |
Released
(2.58+22.10.1)
|
|
| lunar |
Released
(2.59.1+23.04ubuntu1.1)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(2.59.5-1)
|
|
| xenial |
Released
(2.54.3+16.04.0ubuntu0.1~esm6)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 10.0 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |