CVE-2019-7304
Local privilege escalation via snapd socket
CVE-2019-7304 is a high vulnerability (CVSS 8.8) in Canonical Snapd, published February 12, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 60.8%, the 99th percentile. Fixed in snapd 2.37.1-1.
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Local privilege escalation via snapd socket
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
CVE-2019-7304- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2019-16848
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
EUVD-2019-16848- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jvm5-cj73-m9qg
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an...
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
GHSA-jvm5-cj73-m9qg- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
CVE-2019-7304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
CVE-2019-7304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7304
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
DEBIAN-CVE-2019-7304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-7304
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
- Record
UBUNTU-CVE-2019-7304- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3887-1 No score
snapd vulnerability
Chris Moberly discovered that snapd versions 2.28 through 2.37 incorrectly validated and parsed the remote socket address when performing access controls on its UNIX socket. A local attacker could use this to access privileged socket APIs and obtain administrator privileges. On Ubuntu systems with snaps installed, snapd typically will have already automatically refreshed itself to snapd 2.37.1 which is unaffected.
- Record
USN-3887-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snapdDebian:12 |
before 2.37.1-1 | 2.37.1-1 |
snapdDebian:13 |
before 2.37.1-1 | 2.37.1-1 |
snapdDebian:14 |
before 2.37.1-1 | 2.37.1-1 |
snapdUbuntu:14.04:LTS |
before 2.34.2~14.04.1, plus listed versions 2.21~14.04.22.22.2~14.042.22.3~14.042.22.6~14.042.23.1~14.04 Show 10 moreShow less2.24.1~14.042.25~14.042.26.10~14.042.27.5~14.042.28.5~14.042.29.4.2~14.042.32.3.2~14.042.32.9~14.042.33.1~14.042.34.2~14.04 |
2.34.2~14.04.1 |
snapdUbuntu:16.04:LTS |
before 2.34.2ubuntu0.1, plus listed versions 1.91.9.1.11.9.22.02.0.1 Show 29 moreShow less2.0.22.0.32.0.52.0.82.0.92.0.102.11+0.16.042.12+0.16.042.132.14.2~16.042.15.2ubuntu12.16ubuntu32.17.1ubuntu12.20.1ubuntu12.212.22.22.22.32.22.62.23.12.24.12.252.26.102.27.52.28.52.29.4.22.32.3.22.32.92.33.1ubuntu22.34.2 |
2.34.2ubuntu0.1 |
snapdUbuntu:18.04:LTS |
before 2.34.2+18.04.1, plus listed versions 2.28.5+17.102.29.4.1+18.042.29.4.2+18.042.31.1+18.042.32+18.04~pre5 Show 8 moreShow less2.32+18.04~pre62.32+18.042.32.3.2+18.042.32.5+18.042.32.8+18.042.32.9+18.042.33.1+18.04ubuntu22.34.2+18.04 |
2.34.2+18.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1) | 2019-02-13 |
| Exploit-DB | snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2) | 2019-02-13 |
| PoC in GitHub | Kaine105/Document-Linux-Privilege-Escalation | 2025-06-11 |
| PoC in GitHub | SecuritySi/CVE-2019-7304_DirtySock | 2019-02-14 |
| PoC in GitHub | elvi7major/snap_priv_esc | 2021-03-28 |
| PoC in GitHub | f4T1H21/dirty_sock | 2021-07-28 |
| PoC in GitHub | initstring/dirty_sock | 2019-02-12 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |