Skip to content
Fencer Intel
medium 4.8

CVE-2024-29069 json

snapd will follow archived symlinks when unpacking a filesystem

published 2y ago modified 2mo ago also GHSA-69p6-gp5x-j269 , GO-2024-3009 , EUVD-2024-2278

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.

Patch / fix

  • go github.com/snapcore/snapd 2.62
  • Canonical snapd 2.62
  • snapd Debian 14, Debian 13 2.62-1

debian advisories DEBIAN-CVE-2024-29069

  • snapd Ubuntu 20.04 LTS 2.63+20.04ubuntu0.1
  • snapd Ubuntu 22.04 LTS 2.63+22.04ubuntu0.1
  • snapd Ubuntu 24.04 LTS 2.63+24.04ubuntu0.1
  • snapd Ubuntu Pro 16.04 LTS 2.61.4ubuntu0.16.04.1+esm1
  • snapd Ubuntu Pro 18.04 LTS 2.61.4ubuntu0.18.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-29069

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2024-29069 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-29069 updated cvss 5.5

snapd: snapd failed to properly check the destination of symbolic links when extracting a snap

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/snapcore/snapd
<2.62
all versions
2.62

Affected products

  • Canonical snapd

Classification

Weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.