CVE-2024-5138
CVE-2024-5138: snapd snapctl auth bypass
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
- Record
CVE-2024-5138- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-0101
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
- Record
EUVD-2025-0101- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p9v8-q5m4-pf46
CVE-2024-5138: snapd snapctl auth bypass
Impact
A snap with prior permissions to create a mount entry on the host, such as firefox, normally uses the permission from one of the per-snap hook programs. A unprivileged users cannot normally trigger that behaviour by using snap run --shell firefox followed by snapctl mount, since snapd validates the requesting user identity (root or non-root). The issue allows unprivileged users to bypass that check by crafting a malicious command line vector which confuses snapd into thinking the help message is requested.
Unprivileged user on a default installation of Ubuntu, where firefox is as provided as a snap, may cause a denial-of-service attack by repeatedly mounting hunspell database over and over and eventually exhausting system memory.
Other attacks, reliant on the same underying mechanism (mount), are possible. In all cases the snap must be installed and grated permission to perform this action (by connecting an appropriate snap interface), which requires administrative privileges. As such we are focusing on the case of default installation where an unprivileged user may exploit this behavior.
Patches
Patch: https://github.com/canonical/snapd/commit/68ee9c6aa916ab87dbfd9a26030690f2cabf1e14 Release: Available from Snapd 2.64
Workarounds
Users may disconnect any instances of the mount-control interface to prevent snapd from creating such mount points. For example, the firefox snap has the host-hunspell plug, which is of type mount-control. The interface can be disconnected with:
sudo snap disconnect firefox:host-hunspell
References
The original bug report was made on Launchpad: https://bugs.launchpad.net/snapd/+bug/2065077 CVE.org: https://www.cve.org/CVERecord?id=CVE-2024-5138 Canonical: https://ubuntu.com/security/CVE-2024-5138
- Record
GHSA-p9v8-q5m4-pf46- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-285
- Updated
- 2026-11-02
NVD
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
- Record
CVE-2024-5138- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
- Record
CVE-2024-5138- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-5138
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
- Record
DEBIAN-CVE-2024-5138- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-p9v8-q5m4-pf46
CVE-2024-5138: snapd snapctl auth bypass
Impact
A snap with prior permissions to create a mount entry on the host, such as firefox, normally uses the permission from one of the per-snap hook programs. A unprivileged users cannot normally trigger that behaviour by using snap run --shell firefox followed by snapctl mount, since snapd validates the requesting user identity (root or non-root). The issue allows unprivileged users to bypass that check by crafting a malicious command line vector which confuses snapd into thinking the help message is requested.
Unprivileged user on a default installation of Ubuntu, where firefox is as provided as a snap, may cause a denial-of-service attack by repeatedly mounting hunspell database over and over and eventually exhausting system memory.
Other attacks, reliant on the same underying mechanism (mount), are possible. In all cases the snap must be installed and grated permission to perform this action (by connecting an appropriate snap interface), which requires administrative privileges. As such we are focusing on the case of default installation where an unprivileged user may exploit this behavior.
Patches
Patch: https://github.com/canonical/snapd/commit/68ee9c6aa916ab87dbfd9a26030690f2cabf1e14 Release: Available from Snapd 2.64
Workarounds
Users may disconnect any instances of the mount-control interface to prevent snapd from creating such mount points. For example, the firefox snap has the host-hunspell plug, which is of type mount-control. The interface can be disconnected with:
sudo snap disconnect firefox:host-hunspell
References
The original bug report was made on Launchpad: https://bugs.launchpad.net/snapd/+bug/2065077 CVE.org: https://www.cve.org/CVERecord?id=CVE-2024-5138 Canonical: https://ubuntu.com/security/CVE-2024-5138
- Record
GHSA-p9v8-q5m4-pf46- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-5138
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.
- Record
UBUNTU-CVE-2024-5138- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGO-2024-2906 No score
CVE-2024-5138 in github.com/snapcore/snapd
CVE-2024-5138 in github.com/snapcore/snapd
- Record
GO-2024-2906- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/snapcore/snapdGo |
2.51.6 up to 2.63.1 | 2.63.1 |
github.com/snapcore/snapdGo |
before 0.0.0-20240524114846-68ee9c6aa916 | 0.0.0-20240524114846-68ee9c6aa916 |
snapdDebian:12 |
All versions, plus listed versions 2.57.6-12.57.6-1+deb12u12.59.5-12.60.2-12.61.1-1 Show 32 moreShow less2.61.2-12.61.2-22.62-12.62-22.62-32.62-42.62-52.63-12.63-22.63-32.63-42.65.1-12.65.3-12.66.1-12.66.1-22.67-12.68.3-22.68.3-32.71-12.71-22.71-32.72-12.73-32.73-42.74.1-12.75.2-12.75.2-22.76-12.76.3-12.76.3-22.77.1-12.77.1-2 |
None known |
snapdDebian:13 |
before 2.62-3 | 2.62-3 |
snapdDebian:14 |
before 2.62-3 | 2.62-3 |
github.com/snapcore/snapdGo |
All versions | None known |
snapdUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.91.9.1.11.9.22.02.0.1 Show 45 moreShow less2.0.22.0.32.0.52.0.82.0.92.0.102.11+0.16.042.12+0.16.042.132.14.2~16.042.15.2ubuntu12.16ubuntu32.17.1ubuntu12.20.1ubuntu12.212.22.22.22.32.22.62.23.12.24.12.252.26.102.27.52.28.52.29.4.22.32.3.22.32.92.33.1ubuntu22.34.22.34.2ubuntu0.12.37.42.37.4ubuntu0.12.382.39.22.39.2ubuntu0.22.402.42.12.45.12.45.1ubuntu0.22.46.12.47.12.482.48.32.54.3+16.04~esm22.54.3+16.04.0ubuntu0.1~esm3 |
None known |
snapdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.28.5+17.102.29.4.1+18.042.29.4.2+18.042.31.1+18.042.32+18.04~pre5 Show 37 moreShow less2.32+18.04~pre62.32+18.042.32.3.2+18.042.32.5+18.042.32.8+18.042.32.9+18.042.33.1+18.04ubuntu22.34.2+18.042.34.2+18.04.12.37.1+18.042.37.1.1+18.042.37.4+18.042.37.4+18.04.12.38+18.042.39.2+18.042.40+18.042.42.1+18.042.45.1+18.042.45.1+18.04.22.46.1+18.042.47.1+18.042.48+18.042.48.3+18.042.49.2+18.042.51.1+18.042.54.2+18.04ubuntu12.54.3+18.042.54.3+18.04.2ubuntu0.12.54.3+18.04.2ubuntu0.22.55.5+18.042.57.5+18.042.57.5+18.04ubuntu0.12.58+18.042.58+18.04.12.61.4ubuntu0.18.04.1+esm12.61.4ubuntu0.18.04.1+esm22.61.4ubuntu0.18.04.1+esm4 |
None known |
snapdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.41+19.10.12.42.1+20.042.43.3+git1.8109f82.44~pre1+20.042.44+20.04 Show 30 moreShow less2.44.2+20.042.44.3+20.042.45.1+20.042.45.1+20.04.22.46.1+20.042.47.1+20.042.48+20.042.48.3+20.042.49.2+20.042.51.1+20.04ubuntu22.54.2+20.04ubuntu22.54.3+20.042.54.3+20.04.12.54.3+20.04.1ubuntu0.12.54.3+20.04.1ubuntu0.22.54.3+20.04.1ubuntu0.32.55.5+20.042.57.5+20.042.57.5+20.04ubuntu0.12.58+20.042.58+20.04.12.61.3+20.042.62+20.042.63+20.042.63+20.04ubuntu0.12.65.3+20.042.66.1+20.042.67.1+20.042.67.1+20.04ubuntu1~esm12.67.1+20.04ubuntu1~esm3 |
None known |
snapdUbuntu:22.04:LTS |
All versions, plus listed versions 2.53+21.10ubuntu12.54.2+22.04ubuntu12.54.2+22.04ubuntu22.54.2+22.04ubuntu32.54.3+git19.g868fc21+22.04 Show 31 moreShow less2.54.3+git26.g360067e+22.042.55.2+22.042.55.2+22.04.12.55.3+22.042.55.3+22.04ubuntu12.55.5+22.042.56.2+22.04ubuntu12.57.4+22.042.57.5+22.042.57.5+22.04ubuntu0.12.58+22.042.58+22.04.12.61.3+22.042.62+22.042.63+22.042.63+22.04ubuntu0.12.65.3+22.042.66.1+22.042.67.1+22.042.68.5+ubuntu22.04.12.71+ubuntu22.042.72+ubuntu22.042.73+ubuntu22.042.73+ubuntu22.04.12.74.1+ubuntu22.04.42.75.2+ubuntu22.042.76+ubuntu22.042.76+ubuntu22.04.12.76.3+ubuntu22.042.76.3+ubuntu22.04.12.77.1+ubuntu22.04.1 |
None known |
snapdUbuntu:24.04:LTS |
All versions, plus listed versions 2.60.4+23.102.61.3+24.042.62+24.04build12.63+24.042.63+24.04ubuntu0.1 Show 16 moreShow less2.63.1+24.042.65.3+24.042.66.1+24.042.67.1+24.042.68.5+ubuntu24.04.12.71+ubuntu24.042.72+ubuntu24.042.73+ubuntu24.042.73+ubuntu24.04.12.73+ubuntu24.04.22.74.1+ubuntu24.04.42.75.2+ubuntu24.042.76+ubuntu24.042.76+ubuntu24.04.12.76.3+ubuntu24.042.77.1+ubuntu24.04 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-5138 is a high vulnerability (CVSS 8.1) in Canonical Snapd, published May 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in github.com/snapcore/snapd 2.63.1.
References
github.com/snapcore/snapd/commit/68ee9c6aa916ab87dbfd9a26030690f2cabf1e14
bugs.launchpad.net/snapd/+bug/2065077
cve.org/CVERecord?id=CVE-2024-5138
Show 7 moreShow less
Left out here: 6 versions. The JSON record has them.