Read the docs
TI-2024-01603 Aliases CVE-2024-1724GHSA-4mh8-9689-38vr

snapd allows $HOME/bin symlink

Priority HIGH 69CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snap (Canonical): 2.62github.com/snapcore/snapd (Go): 2.62

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalsnapbefore 2.622.62Patch availableCNA
—github.com/snapcore/snapd (Go)before 2.622.62Patch availableGHSA-4mh8-9689-38vr
  • snap VendorCanonical Affected before 2.62 Fixed in 2.62 Patch available CNA
  • github.com/snapcore/snapd (Go) Vendor— Affected before 2.62 Fixed in 2.62 Patch available GHSA-4mh8-9689-38vr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:*before 2.62VulnerableCanonical
  • cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* Versions before 2.62 Vulnerable ·Canonical

Remediation

  • Fix · CNA snap (Canonical) Fixed in 2.62
  • Fix · GHSA-4mh8-9689-38vr github.com/snapcore/snapd (Go) Fixed in 2.62 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1724
  2. 2026-10-03 Alias added: GHSA-4mh8-9689-38vr

References

Exploit 1

Patch 2

Advisory 1

Other 3

  • TI-2023-01437 Injection in Canonical snapd CVSS 3.1CRITICAL 10.0
  • TI-2019-05192 Local privilege escalation via snapd socket CVSS 3.1CRITICAL 9.8
  • TI-2024-04773 Improper input validation in Canonical snapd CVSS 3.1HIGH 8.1
  • TI-2020-16634 Improper privilege management in Canonical snapd CVSS 3.1CRITICAL 9.3
  • TI-2019-05191 Snapd seccomp filter TIOCSTI ioctl bypass CVSS 3.1HIGH 7.5
  • TI-2021-20244 snapd could be made to escalate privileges and run programs as administrator CVSS 3.1HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences