local snapd exploit through cloud-init
Priority LOW 31CWE-264Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-264.
Summary
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
Why it matters now
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Fixed snapd (Canonical): 2.45.2, revision 8539core (Canonical): 2.45.2, revision 9659
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | snapd | 2.45.2 to before 2.45.2, revision 8539 | 2.45.2, revision 8539 | Patch available | CNA |
| Canonical | core | 2.45.2 to before 2.45.2, revision 9659 | 2.45.2, revision 9659 | Patch available | CNA |
- snapd VendorCanonical Affected 2.45.2 to before 2.45.2, revision 8539 Fixed in 2.45.2, revision 8539 Patch available CNA
- core VendorCanonical Affected 2.45.2 to before 2.45.2, revision 9659 Fixed in 2.45.2, revision 9659 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* | before 2.45.2 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
- cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* Versions before 2.45.2 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
Remediation
- Fix · CNA snapd (Canonical) Fixed in 2.45.2, revision 8539
- Fix · CNA core (Canonical) Fixed in 2.45.2, revision 9659
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11933
- 2026-10-03 Alias added: GHSA-v343-8p34-76p3
References
More Canonical Snapd vulnerabilities
- TI-2023-01437 Injection in Canonical snapd CVSS 3.1CRITICAL 10.0
- TI-2019-05192 Local privilege escalation via snapd socket CVSS 3.1CRITICAL 9.8
- TI-2024-01603 snapd allows $HOME/bin symlink CVSS 3.1HIGH 8.2
- TI-2024-04773 Improper input validation in Canonical snapd CVSS 3.1HIGH 8.1
- TI-2020-16634 Improper privilege management in Canonical snapd CVSS 3.1CRITICAL 9.3
- TI-2019-05191 Snapd seccomp filter TIOCSTI ioctl bypass CVSS 3.1HIGH 7.5
Sources
- CVE-2020-11933 · CVE Program
- CVE-2020-11933 · NVD
- FIRST EPSS
- GHSA-v343-8p34-76p3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences