CVE-2024-5138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-5138
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5138.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-5138
Aliases
Downstream
Published
2024-05-31T21:02:19.979Z
Modified
2026-08-27T03:57:02.787665074Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5138.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "68ee9c6aa916ab87dbfd9a26030690f2cabf1e14"
                }
            ]
        }
    ],
    "cna_assigner": "canonical"
}
References

Affected packages

Git / github.com/canonical/snapd

Affected ranges

Type
GIT
Repo
https://github.com/canonical/snapd
Events
Introduced
93552979bad10e6f45fc28cce99ebfe6c69b7a01
Fixed
3ba5d67ca332f9fcb408ad0ad3cc70b3d67869ca
Fixed
68ee9c6aa916ab87dbfd9a26030690f2cabf1e14
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.51.6"
        },
        {
            "fixed": "2.63.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5138.json"