{"id":"CVE-2019-7303","aliases":["DEBIAN-CVE-2019-7303","EUVD-2019-16847","GHSA-hhhq-qgvm-w5hp","UBUNTU-CVE-2019-7303","USN-3917-1"],"status":"published","title":"Snapd seccomp filter TIOCSTI ioctl bypass","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","severity":{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.037,"percentile":0.89808,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-628"],"published":"2019-03-21T00:00:00Z","modified":"2026-10-24T10:31:03Z","exploits":[{"source":"exploitdb","id":"EDB-46594","title":"snap - seccomp BBlacklist for TIOCSTI can be Circumvented","type":"dos","platform":"linux","date":"2019-03-22","verified":true,"url":"https://www.exploit-db.com/exploits/46594"}],"fixes":[{"ecosystem":"Debian:12","package":"snapd","fixed_in":["2.37.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"snapd","fixed_in":["2.37.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"snapd","fixed_in":["2.37.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"snapd","fixed_in":["2.37.4~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"snapd","fixed_in":["2.37.4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"snapd","fixed_in":["2.37.4+18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4~14.04.1"}]}],"versions":["2.21~14.04.2","2.22.2~14.04","2.22.3~14.04","2.22.6~14.04","2.23.1~14.04","2.24.1~14.04","2.25~14.04","2.26.10~14.04","2.27.5~14.04","2.28.5~14.04","2.29.4.2~14.04","2.32.3.2~14.04","2.32.9~14.04","2.33.1~14.04","2.34.2~14.04","2.34.2~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4ubuntu0.1"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4+18.04.1"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4~14.04.1"}]}],"versions":["2.21~14.04.2","2.22.2~14.04","2.22.3~14.04","2.22.6~14.04","2.23.1~14.04","2.24.1~14.04","2.25~14.04","2.26.10~14.04","2.27.5~14.04","2.28.5~14.04","2.29.4.2~14.04","2.32.3.2~14.04","2.32.9~14.04","2.33.1~14.04","2.34.2~14.04","2.34.2~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4ubuntu0.1"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.4+18.04.1"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04"]}],"products":[{"vendor":"canonical","product":"snapd"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"canonical ltd.","product":"snapd"}],"references":[{"url":"https://usn.ubuntu.com/3917-1/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/46594","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7303"},{"url":"https://github.com/advisories/GHSA-hhhq-qgvm-w5hp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-7303","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-7303","tags":["report"]},{"url":"https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SnapIoctlTIOCSTI","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3917-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7303","tags":["report"]},{"url":"https://launchpad.net/bugs/1812973","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-7303","title":"Snapd seccomp filter TIOCSTI ioctl bypass","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2019-04-23T15:57:32.592Z","modified":"2024-09-17T01:46:16.086Z","cvss":[{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-628"],"updated_at":"2026-11-02T14:32:22.854093Z"}],"euvd":[{"id":"EUVD-2019-16847","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2019-04-23T15:57:32Z","modified":"2024-09-17T01:46:16Z","cvss":[{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:46.561775Z"}],"ghsa":[{"id":"GHSA-hhhq-qgvm-w5hp","title":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict...","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2022-05-24T16:44:30Z","modified":"2023-01-28T05:05:17Z","updated_at":"2026-11-02T14:44:19.546147Z"}],"nvd":[{"id":"CVE-2019-7303","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2019-04-23T16:29:10.64Z","modified":"2026-06-17T02:40:25.11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-628"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"CVE-2019-7303","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2019-04-23T16:29:10.64Z","modified":"2026-10-24T10:31:03.111136259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-7303","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2019-04-23T16:29:10.64Z","modified":"2026-09-21T07:03:23.253019162Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-7303","description":"A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 bits to determine which ioctl(2) commands to run. This issue affects: Canonical snapd versions prior to 2.37.4.","status":"published","published":"2019-03-21T00:00:00Z","modified":"2026-02-04T02:28:31.449762Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","level":"medium"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"USN-3917-1","title":"snapd vulnerability","description":"The snapd default seccomp filter for strict mode snaps blocks the use of\nthe ioctl() system call when used with TIOCSTI as the second argument to\nthe system call. Jann Horn discovered that this restriction could be\ncircumvented on 64 bit architectures. A malicious snap could exploit this\nto bypass intended access restrictions to insert characters into the\nterminal's input queue. On Ubuntu, snapd typically will have already\nautomatically refreshed itself to snapd 2.37.4 which is unaffected.\n","status":"published","published":"2019-03-21T20:46:02Z","modified":"2026-02-10T04:41:29Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}