Injection in Canonical snapd
Priority HIGH 82CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01447 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snapd (Canonical Ltd.): 2.59.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | snapd | — | 2.59.5 | Patch available | CNA |
- snapd VendorCanonical Affected — Fixed in 2.59.5 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* | before 2.59.5 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* | 22.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:* | 22.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:* | 23.04 | Vulnerable | Canonical |
- cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* Versions before 2.59.5 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:* Versions 22.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:* Versions 23.04 Vulnerable ·Canonical
Remediation
- Fix · CNA snapd (Canonical Ltd.) Fixed in 2.59.5
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1523
- 2026-10-03 Alias added: GHSA-55wx-23fj-c2v5
References
More Canonical Snapd vulnerabilities
- TI-2019-05192 Local privilege escalation via snapd socket CVSS 3.1CRITICAL 9.8
- TI-2024-01603 snapd allows $HOME/bin symlink CVSS 3.1HIGH 8.2
- TI-2024-04773 Improper input validation in Canonical snapd CVSS 3.1HIGH 8.1
- TI-2020-16634 Improper privilege management in Canonical snapd CVSS 3.1CRITICAL 9.3
- TI-2019-05191 Snapd seccomp filter TIOCSTI ioctl bypass CVSS 3.1HIGH 7.5
- TI-2021-20244 snapd could be made to escalate privileges and run programs as administrator CVSS 3.1HIGH 8.8
Sources
- CVE-2023-1523 · CVE Program
- CVE-2023-1523 · NVD
- FIRST EPSS
- GHSA-55wx-23fj-c2v5 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-1523 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences