{"id":"CVE-2024-1724","aliases":["DEBIAN-CVE-2024-1724","EUVD-2024-2247","GHSA-4mh8-9689-38vr","GO-2024-3007","UBUNTU-CVE-2024-1724","USN-6940-1","USN-6940-2"],"status":"published","title":"snapd allows $HOME/bin symlink","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of \nsandbox permissions, snapd failed to restrict writes to the $HOME/bin\npath. In Ubuntu, when this path exists, it is automatically added to\nthe users PATH. An attacker who could convince a user to install a\nmalicious snap which used the 'home' plug could use this vulnerability\nto install arbitrary scripts into the users PATH which may then be run\nby the user outside of the expected snap sandbox and hence allow them\nto escape confinement.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00306,"percentile":0.23633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2024-07-01T00:00:00Z","modified":"2026-11-02T12:00:57Z","fixes":[{"ecosystem":"Go","package":"github.com/snapcore/snapd","fixed_in":["2.62"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"snapd","fixed_in":["2.62-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"snapd","fixed_in":["2.62-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snapd","fixed_in":["2.61.4ubuntu0.16.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snapd","fixed_in":["2.61.4ubuntu0.18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"snapd","fixed_in":["2.63+20.04ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"snapd","fixed_in":["2.63+22.04ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"snapd","fixed_in":["2.63+24.04ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/snapcore/snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.57.6-1","2.57.6-1+deb12u1","2.59.5-1","2.60.2-1","2.61.1-1","2.61.2-1","2.61.2-2","2.62-1","2.62-2","2.62-3","2.62-4","2.62-5","2.63-1","2.63-2","2.63-3","2.63-4","2.65.1-1","2.65.3-1","2.66.1-1","2.66.1-2","2.67-1","2.68.3-2","2.68.3-3","2.71-1","2.71-2","2.71-3","2.72-1","2.73-3","2.73-4","2.74.1-1","2.75.2-1","2.75.2-2","2.76-1","2.76.3-1","2.76.3-2","2.77.1-1","2.77.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/snapcore/snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/snapcore/snapd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61.4ubuntu0.16.04.1+esm1"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4","2.37.4ubuntu0.1","2.38","2.39.2","2.39.2ubuntu0.2","2.40","2.42.1","2.45.1","2.45.1ubuntu0.2","2.46.1","2.47.1","2.48","2.48.3","2.54.3+16.04~esm2","2.54.3+16.04.0ubuntu0.1~esm3","2.54.3+16.04.0ubuntu0.1~esm4","2.54.3+16.04.0ubuntu0.1~esm5","2.54.3+16.04.0ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61.4ubuntu0.18.04.1+esm1"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04","2.37.4+18.04.1","2.38+18.04","2.39.2+18.04","2.40+18.04","2.42.1+18.04","2.45.1+18.04","2.45.1+18.04.2","2.46.1+18.04","2.47.1+18.04","2.48+18.04","2.48.3+18.04","2.49.2+18.04","2.51.1+18.04","2.54.2+18.04ubuntu1","2.54.3+18.04","2.54.3+18.04.2ubuntu0.1","2.54.3+18.04.2ubuntu0.2","2.55.5+18.04","2.57.5+18.04","2.57.5+18.04ubuntu0.1","2.58+18.04","2.58+18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+20.04ubuntu0.1"}]}],"versions":["2.41+19.10.1","2.42.1+20.04","2.43.3+git1.8109f8","2.44~pre1+20.04","2.44+20.04","2.44.2+20.04","2.44.3+20.04","2.45.1+20.04","2.45.1+20.04.2","2.46.1+20.04","2.47.1+20.04","2.48+20.04","2.48.3+20.04","2.49.2+20.04","2.51.1+20.04ubuntu2","2.54.2+20.04ubuntu2","2.54.3+20.04","2.54.3+20.04.1","2.54.3+20.04.1ubuntu0.1","2.54.3+20.04.1ubuntu0.2","2.54.3+20.04.1ubuntu0.3","2.55.5+20.04","2.57.5+20.04","2.57.5+20.04ubuntu0.1","2.58+20.04","2.58+20.04.1","2.61.3+20.04","2.62+20.04","2.63+20.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+22.04ubuntu0.1"}]}],"versions":["2.53+21.10ubuntu1","2.54.2+22.04ubuntu1","2.54.2+22.04ubuntu2","2.54.2+22.04ubuntu3","2.54.3+git19.g868fc21+22.04","2.54.3+git26.g360067e+22.04","2.55.2+22.04","2.55.2+22.04.1","2.55.3+22.04","2.55.3+22.04ubuntu1","2.55.5+22.04","2.56.2+22.04ubuntu1","2.57.4+22.04","2.57.5+22.04","2.57.5+22.04ubuntu0.1","2.58+22.04","2.58+22.04.1","2.61.3+22.04","2.62+22.04","2.63+22.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+24.04ubuntu0.1"}]}],"versions":["2.60.4+23.10","2.61.3+24.04","2.62+24.04build1","2.63+24.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+20.04ubuntu0.1"}]}],"versions":["2.41+19.10.1","2.42.1+20.04","2.43.3+git1.8109f8","2.44~pre1+20.04","2.44+20.04","2.44.2+20.04","2.44.3+20.04","2.45.1+20.04","2.45.1+20.04.2","2.46.1+20.04","2.47.1+20.04","2.48+20.04","2.48.3+20.04","2.49.2+20.04","2.51.1+20.04ubuntu2","2.54.2+20.04ubuntu2","2.54.3+20.04","2.54.3+20.04.1","2.54.3+20.04.1ubuntu0.1","2.54.3+20.04.1ubuntu0.2","2.54.3+20.04.1ubuntu0.3","2.55.5+20.04","2.57.5+20.04","2.57.5+20.04ubuntu0.1","2.58+20.04","2.58+20.04.1","2.61.3+20.04","2.62+20.04","2.63+20.04"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+22.04ubuntu0.1"}]}],"versions":["2.53+21.10ubuntu1","2.54.2+22.04ubuntu1","2.54.2+22.04ubuntu2","2.54.2+22.04ubuntu3","2.54.3+git19.g868fc21+22.04","2.54.3+git26.g360067e+22.04","2.55.2+22.04","2.55.2+22.04.1","2.55.3+22.04","2.55.3+22.04ubuntu1","2.55.5+22.04","2.56.2+22.04ubuntu1","2.57.4+22.04","2.57.5+22.04","2.57.5+22.04ubuntu0.1","2.58+22.04","2.58+22.04.1","2.61.3+22.04","2.62+22.04","2.63+22.04"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+24.04ubuntu0.1"}]}],"versions":["2.60.4+23.10","2.61.3+24.04","2.62+24.04build1","2.63+24.04"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61.4ubuntu0.16.04.1+esm1"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4","2.37.4ubuntu0.1","2.38","2.39.2","2.39.2ubuntu0.2","2.40","2.42.1","2.45.1","2.45.1ubuntu0.2","2.46.1","2.47.1","2.48","2.48.3","2.54.3+16.04~esm2","2.54.3+16.04.0ubuntu0.1~esm3","2.54.3+16.04.0ubuntu0.1~esm4","2.54.3+16.04.0ubuntu0.1~esm5","2.54.3+16.04.0ubuntu0.1~esm6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.61.4ubuntu0.18.04.1+esm1"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04","2.37.4+18.04.1","2.38+18.04","2.39.2+18.04","2.40+18.04","2.42.1+18.04","2.45.1+18.04","2.45.1+18.04.2","2.46.1+18.04","2.47.1+18.04","2.48+18.04","2.48.3+18.04","2.49.2+18.04","2.51.1+18.04","2.54.2+18.04ubuntu1","2.54.3+18.04","2.54.3+18.04.2ubuntu0.1","2.54.3+18.04.2ubuntu0.2","2.55.5+18.04","2.57.5+18.04","2.57.5+18.04ubuntu0.1","2.58+18.04","2.58+18.04.1"],"bundled":3}],"products":[{"vendor":"canonical","product":"snap"},{"vendor":"canonical","product":"snapd"}],"references":[{"url":"https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6","tags":["x_transferred","Patch","fix","web"]},{"url":"https://gld.mcphail.uk/posts/explaining-cve-2024-1724/","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","web","report"]},{"url":"https://github.com/snapcore/snapd/pull/13689","tags":["x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1724","tags":["advisory"]},{"url":"https://gld.mcphail.uk/posts/explaining-cve-2024-1724","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4mh8-9689-38vr","tags":["advisory"]},{"url":"https://github.com/snapcore/snapd/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1724.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-1724","tags":["advisory"]},{"url":"https://github.com/snapcore/snapd","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-1724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1724","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6940-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6940-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-29069","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-1724","title":"snapd allows $HOME/bin symlink","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of \nsandbox permissions, snapd failed to restrict writes to the $HOME/bin\npath. In Ubuntu, when this path exists, it is automatically added to\nthe users PATH. An attacker who could convince a user to install a\nmalicious snap which used the 'home' plug could use this vulnerability\nto install arbitrary scripts into the users PATH which may then be run\nby the user outside of the expected snap sandbox and hence allow them\nto escape confinement.","status":"published","published":"2024-07-25T19:05:23.299Z","modified":"2024-08-01T18:48:21.887Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-2247","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of \nsandbox permissions, snapd failed to restrict writes to the $HOME/bin\npath. In Ubuntu, when this path exists, it is automatically added to\nthe users PATH. An attacker who could convince a user to install a\nmalicious snap which used the 'home' plug could use this vulnerability\nto install arbitrary scripts into the users PATH which may then be run\nby the user outside of the expected snap sandbox and hence allow them\nto escape confinement.","status":"published","published":"2024-07-25T19:05:23Z","modified":"2024-08-01T18:48:21Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:40.972877Z"}],"ghsa":[{"id":"GHSA-4mh8-9689-38vr","title":"snapd failed to restrict writes to the $HOME/bin path","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.","status":"published","published":"2024-07-25T21:31:20Z","modified":"2024-08-07T15:10:52Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2024-1724","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of \nsandbox permissions, snapd failed to restrict writes to the $HOME/bin\npath. In Ubuntu, when this path exists, it is automatically added to\nthe users PATH. An attacker who could convince a user to install a\nmalicious snap which used the 'home' plug could use this vulnerability\nto install arbitrary scripts into the users PATH which may then be run\nby the user outside of the expected snap sandbox and hence allow them\nto escape confinement.","status":"published","published":"2024-07-25T19:15:09.913Z","modified":"2026-06-17T07:04:52.453Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:10:14.437386Z"}],"osv":[{"id":"CVE-2024-1724","title":"snapd allows $HOME/bin symlink","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of \nsandbox permissions, snapd failed to restrict writes to the $HOME/bin\npath. In Ubuntu, when this path exists, it is automatically added to\nthe users PATH. An attacker who could convince a user to install a\nmalicious snap which used the 'home' plug could use this vulnerability\nto install arbitrary scripts into the users PATH which may then be run\nby the user outside of the expected snap sandbox and hence allow them\nto escape confinement.","status":"published","published":"2024-07-25T19:05:23.299Z","modified":"2026-10-28T02:30:25.396074333Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-1724","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of  sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.","status":"published","published":"2024-07-25T19:15:09.913Z","modified":"2026-11-02T12:00:57.747759946Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-4mh8-9689-38vr","title":"snapd failed to restrict writes to the $HOME/bin path","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.","status":"published","published":"2024-07-25T21:31:20Z","modified":"2026-09-10T03:50:16.240747968Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"UBUNTU-CVE-2024-1724","description":"In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2026-02-04T03:40:40.687445Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"GO-2024-3007","title":"snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd","description":"snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/snapcore/snapd before v2.62.0.","status":"published","published":"2024-08-06T22:03:16Z","modified":"2024-08-06T22:27:08.054502Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"USN-6940-1","title":"snapd vulnerabilities","description":"Neil McPhail discovered that snapd did not properly restrict writes to the\n$HOME/bin path in the AppArmor profile for snaps using the home plug. An\nattacker who could convince a user to install a malicious snap could use this\nvulnerability to escape the snap sandbox. (CVE-2024-1724)\n\nZeyad Gouda discovered that snapd failed to properly check the file type when\nextracting a snap. An attacker who could convince a user to install a malicious\nsnap containing non-regular files could then cause snapd to block indefinitely\nwhile trying to read from such files and cause a denial of\nservice. (CVE-2024-29068)\n\nZeyad Gouda discovered that snapd failed to properly check the destination of\nsymbolic links when extracting a snap. An attacker who could convince a user to\ninstall a malicious snap containing crafted symbolic links could then cause\nsnapd to write out the contents of the symbolic link destination into a\nworld-readable directory. This in-turn could allow a local unprivileged user to\ngain access to privileged information. (CVE-2024-29069)\n","status":"published","published":"2024-08-01T06:35:51Z","modified":"2026-02-10T04:44:43Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6940-2","title":"snapd vulnerabilities","description":"USN-6940-1 fixed vulnerabilities in snapd. This update provides the \ncorresponding updates for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.\n\nOriginal advisory details:\n\n Neil McPhail discovered that snapd did not properly restrict writes to\n the /home/jslarraz/bin path in the AppArmor profile for snaps using the home\n plug. An attacker who could convince a user to install a malicious snap\n could use this vulnerability to escape the snap sandbox. (CVE-2024-1724)\n \n Zeyad Gouda discovered that snapd failed to properly check the file type\n when extracting a snap. An attacker who could convince a user to install\n a malicious snap containing non-regular files could then cause snapd to\n block indefinitely while trying to read from such files and cause a\n denial of service. (CVE-2024-29068)\n \n Zeyad Gouda discovered that snapd failed to properly check the\n destination of symbolic links when extracting a snap. An attacker who\n could convince a user to install a malicious snap containing crafted\n symbolic links could then cause snapd to write out the contents of the\n symbolic link destination into a world-readable directory. This in-turn\n could allow a local unprivileged user to gain access to privileged\n information. (CVE-2024-29069)\n","status":"published","published":"2025-01-13T10:16:20Z","modified":"2026-06-25T13:32:28.728263233Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}