Read the docs
TI-2024-04924 Aliases CVE-2024-5300GHSA-px3v-8ppp-543h

AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized…

Priority LOW 24CWE-212Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Fixed snapd: 2.76.1Ubuntu 26.04 LTS (Canonical): 2.76+ubuntu26.04.3+5 more productsRed Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—snapdbefore 2.76.12.76.1Patch availableCNA
CanonicalUbuntu 26.04 LTS—2.76+ubuntu26.04.3Patch availableCNA
CanonicalUbuntu 24.04 LTS—2.76+ubuntu24.04.1Patch availableCNA
CanonicalUbuntu 22.04 LTS—2.76+ubuntu22.04.1Patch availableCNA
CanonicalUbuntu 20.04 LTS—2.67.1+20.04ubuntu1~esm2Patch availableCNA
CanonicalUbuntu 18.04 LTS—2.61.4ubuntu0.18.04.1+esm3Patch availableCNA
CanonicalUbuntu 16.04 LTS—2.61.4ubuntu0.16.04.1+esm3Patch availableCNA
  • snapd Vendor— Affected before 2.76.1 Fixed in 2.76.1 Patch available CNA
  • Ubuntu 26.04 LTS VendorCanonical Affected — Fixed in 2.76+ubuntu26.04.3 Patch available CNA
  • Ubuntu 24.04 LTS VendorCanonical Affected — Fixed in 2.76+ubuntu24.04.1 Patch available CNA
  • Ubuntu 22.04 LTS VendorCanonical Affected — Fixed in 2.76+ubuntu22.04.1 Patch available CNA
  • Ubuntu 20.04 LTS VendorCanonical Affected — Fixed in 2.67.1+20.04ubuntu1~esm2 Patch available CNA
  • Ubuntu 18.04 LTS VendorCanonical Affected — Fixed in 2.61.4ubuntu0.18.04.1+esm3 Patch available CNA
  • Ubuntu 16.04 LTS VendorCanonical Affected — Fixed in 2.61.4ubuntu0.16.04.1+esm3 Patch available CNA

Remediation

  • Fix · CNA snapd Fixed in 2.76.1
  • Fix · CNA Ubuntu 26.04 LTS (Canonical) Fixed in 2.76+ubuntu26.04.3
  • Fix · CNA Ubuntu 24.04 LTS (Canonical) Fixed in 2.76+ubuntu24.04.1
  • Fix · CNA Ubuntu 22.04 LTS (Canonical) Fixed in 2.76+ubuntu22.04.1
  • Fix · CNA Ubuntu 20.04 LTS (Canonical) Fixed in 2.67.1+20.04ubuntu1~esm2
  • Fix · CNA Ubuntu 18.04 LTS (Canonical) Fixed in 2.61.4ubuntu0.18.04.1+esm3
  • Fix · CNA Ubuntu 16.04 LTS (Canonical) Fixed in 2.61.4ubuntu0.16.04.1+esm3

Red Hat 1 advisory

  • RHSA-2026:29009 Released 2026-06-24 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images systemd-261-2.hum1@aarch64, systemd-261-2.hum1@src, systemd-261-2.hum1@x86_64 +40

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:29009

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-5300
  2. 2026-10-03 Alias added: GHSA-px3v-8ppp-543h

References

Other 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences