CVE-2024-29068

mediumPriorität · verfolgen · 26EPSS 0.002 · 11. PerzentilDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.21% (11th) EPSS
CVSS 6.6 · medium
Is it mine?
11 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

01

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.6
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.3 · Auswirkung 5.2
v3.16.6mediumAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.15.8mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Hsecondary · ENISA EU
v3.15.8mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Hsecondary · security@ubuntu.comAusnutzbarkeit 0.6 · Auswirkung 5.2
v3.15.8mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Hsecondary · OSV
v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
02

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-20USCWE-20US
04

betroffene Produkte (11)

Betroffene Produkte und Versionsbereiche.

05

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

  • WID-SEC-W-2024-1712Canonical Snap: Mehrere SchwachstellenDeutsch2024-07-25csaf · cert_bundDE

    Ein lokaler Angreifer kann mehrere Schwachstellen in Canonical Snap ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um einen Denial of Service Zustand herbeizuführen.

  • GHSA-64jh-cjwc-w8q6snapd failed to properly check the file type when extracting a snap2024-07-25ghsa · osvUS

    In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

  • GO-2024-3008snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd2024-08-06vendor · osvUS

    snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/snapcore/snapd before v2.62.0.

06

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdNVDCVE.orgMITRE
veröffentlicht 2024-07-25geändert 2026-06-17
08

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan