Skip to content
Fencer Vulns
medium 5.8

CVE-2024-29068 json

snapd non-regular file indefinite blocking read

published 2024-07-25 2 y ago modified 2026-09-10 1 mo ago also GHSA-64jh-cjwc-w8q6 , GO-2024-3008 , EUVD-2024-2275

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

Patch / fix

  • go github.com/snapcore/snapd 2.62
  • Canonical snapd 2.62
  • snapd Debian 14, Debian 13 2.62-1

debian advisories DEBIAN-CVE-2024-29068

  • snapd Ubuntu 20.04 LTS 2.63+20.04ubuntu0.1
  • snapd Ubuntu 22.04 LTS 2.63+22.04ubuntu0.1
  • snapd Ubuntu 24.04 LTS 2.63+24.04ubuntu0.1
  • snapd Ubuntu Pro 16.04 LTS 2.61.4ubuntu0.16.04.1+esm1
  • snapd Ubuntu Pro 18.04 LTS 2.61.4ubuntu0.18.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-29068

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-29068 updated cvss 5.5

snapd: snapd failed to properly check the file type when extracting a snap

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H
NVD 3.1 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
GitHub 3.1 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/snapcore/snapd
<2.62
all versions
2.62

Affected products

  • Canonical snapd

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.