CVE-2019-7303

2019-03-2100:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.02 Low

EPSS

Percentile

88.8%

JSON

A vulnerability in the seccomp filters of Canonical snapd before version
2.37.4 allows a strict mode snap to insert characters into a terminal on a
64-bit host. The seccomp rules were generated to match 64-bit ioctl(2)
commands on a 64-bit platform; however, the Linux kernel only uses the
lower 32 bits to determine which ioctl(2) commands to run. This issue
affects: Canonical snapd versions prior to 2.37.4.

Bugs

<https://launchpad.net/bugs/1812973>

Notes

Author	Note
jdstrand	this is a kernel limitation that is documented in the seccomp man page, but arguably the kernel should perform the seccomp filter check on the value that it is ultimately going to process (which likely means an improvement to libseccomp to generate the appropriate BPF to do this) this was further complicated by the fact that the kernel and glibc disagree on the function prototype of ioctl, where the glibc man page documents it as unsigned long and the kernel treats it as int (note, the tty_ioctl man page (which is the one that documents TIOCSTI) lists the ioctl second argument as an int) due to miscoordination, 2.37.4 is going to -updates first as part of the regular SRU cycle. Once that passes, we’ll rebuild and publish to the security pocket and issue a USN. once this issue is public, the global profile initialization code that is used to address this issue will also be made public

Author

Note

jdstrand

this is a kernel limitation that is documented in the seccomp man page, but arguably the kernel should perform the seccomp filter check on the value that it is ultimately going to process (which likely means an improvement to libseccomp to generate the appropriate BPF to do this) this was further complicated by the fact that the kernel and glibc disagree on the function prototype of ioctl, where the glibc man page documents it as unsigned long and the kernel treats it as int (note, the tty_ioctl man page (which is the one that documents TIOCSTI) lists the ioctl second argument as an int) due to miscoordination, 2.37.4 is going to -updates first as part of the regular SRU cycle. Once that passes, we’ll rebuild and publish to the security pocket and issue a USN. once this issue is public, the global profile initialization code that is used to address this issue will also be made public

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchsnapd< 2.37.4+18.04UNKNOWN
ubuntu18.10noarchsnapd< 2.37.4+18.10UNKNOWN
ubuntu14.04noarchsnapd< 2.37.4~14.04UNKNOWN
ubuntu16.04noarchsnapd< 2.37.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	snapd	< 2.37.4+18.04	UNKNOWN
ubuntu	18.10	noarch	snapd	< 2.37.4+18.10	UNKNOWN
ubuntu	14.04	noarch	snapd	< 2.37.4~14.04	UNKNOWN
ubuntu	16.04	noarch	snapd	< 2.37.4	UNKNOWN