CVE-2019-7303 (retired)

Priority
Description
The snapd seccomp filter is configured to block ioctl(..., TIOCSTI, ...) but
in snapd < 2.37.4 this could be circumvented on 64 bit architectures by
setting any high bits in the 2nd argument to ioctl.
Notes
 jdstrand> this is a kernel limitation that is documented in the seccomp man
  page, but arguably the kernel should perform the seccomp filter check on the
  value that it is ultimately going to process (which likely means an
  improvement to libseccomp to generate the appropriate BPF to do this)
 jdstrand> this was further complicated by the fact that the kernel and glibc
  disagree on the function prototype of ioctl, where the glibc man page
  documents it as unsigned long and the kernel treats it as int (note, the
  tty_ioctl man page (which is the one that documents TIOCSTI) lists the ioctl
  second argument as an int)
 jdstrand> due to miscoordination, 2.37.4 is going to -updates first as part of
  the regular SRU cycle. Once that passes, we'll rebuild and publish to the
  security pocket and issue a USN.
 jdstrand> once this issue is public, the global profile initialization code
  that is used to address this issue will also be made public
Assigned-to
zyga
Package
Source: snapd (LP Ubuntu Debian)
Upstream:released (2.37.4)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 LTS (Trusty Tahr):released (2.37.4~14.04)
Ubuntu 16.04 LTS (Xenial Xerus):released (2.37.4)
Ubuntu 18.04 LTS (Bionic Beaver):released (2.37.4+18.04)
Ubuntu 18.10 (Cosmic Cuttlefish):released (2.37.4+18.10)
Ubuntu 19.04 (Disco Dingo):not-affected (2.37.4+19.04)
Patches:
Upstream:https://github.com/snapcore/snapd/pull/6516 (part 1)
Upstream:https://github.com/snapcore/snapd/pull/6533 (part 2)
More Information

Updated: 2019-03-26 12:27:56 UTC (commit ccdecfcf0fead22bd291e5f4ea745a46872dcb15)