Read the docs
TI-2024-04773 Aliases CVE-2024-5138GHSA-p9v8-q5m4-pf46

Improper input validation in Canonical snapd

Priority HIGH 68CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00834 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snapd (Canonical Ltd.): 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14github.com/snapcore/snapd (Go): 2.63.1, 0.0.0-20240524114846-68ee9c6aa916

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalsnapdbefore 68ee9c6aa916ab87dbfd9a26030690f2cabf1e1468ee9c6aa916ab87dbfd9a26030690f2cabf1e14Patch availableCNA
—github.com/snapcore/snapd (Go)2.51.6 to before 2.63.12.63.1Patch availableGHSA-p9v8-q5m4-pf46
—github.com/snapcore/snapd (Go)before 0.0.0-20240524114846-68ee9c6aa9160.0.0-20240524114846-68ee9c6aa916Patch availableGHSA-p9v8-q5m4-pf46
  • snapd VendorCanonical Affected before 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14 Fixed in 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14 Patch available CNA
  • github.com/snapcore/snapd (Go) Vendor— Affected 2.51.6 to before 2.63.1 Fixed in 2.63.1 Patch available GHSA-p9v8-q5m4-pf46
  • github.com/snapcore/snapd (Go) Vendor— Affected before 0.0.0-20240524114846-68ee9c6aa916 Fixed in 0.0.0-20240524114846-68ee9c6aa916 Patch available GHSA-p9v8-q5m4-pf46

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:*2.51.6 to before 2.63.1VulnerableCanonical
  • cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* Versions 2.51.6 to before 2.63.1 Vulnerable ·Canonical

Remediation

  • Fix · CNA snapd (Canonical Ltd.) Fixed in 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14
  • Fix · GHSA-p9v8-q5m4-pf46 github.com/snapcore/snapd (Go) Fixed in 2.63.1 Advisory →
  • Fix · GHSA-p9v8-q5m4-pf46 github.com/snapcore/snapd (Go) Fixed in 0.0.0-20240524114846-68ee9c6aa916 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-5138
  2. 2026-10-03 Alias added: GHSA-p9v8-q5m4-pf46

References

Exploit 1

Patch 1

Advisory 2

Other 4

  • TI-2023-01437 Injection in Canonical snapd CVSS 3.1CRITICAL 10.0
  • TI-2019-05192 Local privilege escalation via snapd socket CVSS 3.1CRITICAL 9.8
  • TI-2024-01603 snapd allows $HOME/bin symlink CVSS 3.1HIGH 8.2
  • TI-2020-16634 Improper privilege management in Canonical snapd CVSS 3.1CRITICAL 9.3
  • TI-2019-05191 Snapd seccomp filter TIOCSTI ioctl bypass CVSS 3.1HIGH 7.5
  • TI-2021-20244 snapd could be made to escalate privileges and run programs as administrator CVSS 3.1HIGH 8.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences