Paper/Archive/CVE-2023-1523

CVE-2023-1523

Canonical Ltd. snapd — Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it…

EPSS 1%public exploit CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA, NVD agree)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 73.3.733 × 2014.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.

Affected

ProductAffectedFixed inSource

snapdsee advisory2.59.5CNA

Scores by source

canonical (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

advisoryubuntu.com/security/notices/USN-6125-1 refgithub.com/snapcore/snapd/pull/12849 refmarc.info/?l=oss-security&m=167879021709955&w=2 refcve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1523