Improper privilege management in Canonical snapd
Priority MEDIUM 42CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snapd (Canonical Ltd.): 2.48.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | snapd | before 2.48.3 | 2.48.3 | Patch available | CNA |
- snapd VendorCanonical Affected before 2.48.3 Fixed in 2.48.3 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* | before 2.48.3 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:* | 20.10 | Vulnerable | Canonical |
- cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* Versions before 2.48.3 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:* Versions 20.10 Vulnerable ·Canonical
Remediation
- Fix · CNA snapd (Canonical Ltd.) Fixed in 2.48.3
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27352
- 2026-10-03 Alias added: GHSA-3hqj-7v65-62fj
References
More Canonical Snapd vulnerabilities
- TI-2023-01437 Injection in Canonical snapd CVSS 3.1CRITICAL 10.0
- TI-2019-05192 Local privilege escalation via snapd socket CVSS 3.1CRITICAL 9.8
- TI-2024-01603 snapd allows $HOME/bin symlink CVSS 3.1HIGH 8.2
- TI-2024-04773 Improper input validation in Canonical snapd CVSS 3.1HIGH 8.1
- TI-2019-05191 Snapd seccomp filter TIOCSTI ioctl bypass CVSS 3.1HIGH 7.5
- TI-2021-20244 snapd could be made to escalate privileges and run programs as administrator CVSS 3.1HIGH 8.8
Sources
- CVE-2020-27352 · CVE Program
- CVE-2020-27352 · NVD
- FIRST EPSS
- GHSA-3hqj-7v65-62fj · GitHub Advisory Database · CC BY 4.0
- CVE-2020-27352 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences