CVE-2020-11934

Priority
Description
It was discovered that snapctl user-open allowed altering the
$XDG_DATA_DIRS environment variable when calling the system xdg-open.
OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to
append a path to a directory controlled by the calling snap. A malicious
snap could exploit this to bypass intended access restrictions to control
how the host system xdg-open script opens the URL and, for example, execute
a script shipped with the snap without confinement. This issue did not
affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2,
2.45.1+18.04.2 and 2.45.1+20.04.2.
Ubuntu-Description
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS
environment variable when calling the system xdg-open. A malicious snap
could exploit this to bypass intended access restrictions to control how
the host system xdg-open script opens the URL. This issue did not affect
Ubuntu Core systems. (CVE-2020-11934)
Assigned-to
emitorino
Notes
emitorinoSince the vulnerability is present on the userd's OpenURL
implementation, it only affects classic distros where userd is
auto-started.
Since userd cannot be auto-started on Ubuntu Core 16, Ubuntu
Core 18 or Ubuntu Core 20 (for various reasons depending on the
release), then Ubuntu Core is not affected.
Even if userd happened to start (eg, the user started it
manually on UC20) there is no implicitOnCore policy that allows
communicating with io.snapcraft.Launcher (or the older
com.canonical.SafeLauncher).
The dbus interface can't be used (with either plugs or slots)
to communicate with userd.
/usr/bin/xdg-open on the boot file system of an Ubuntu Core
system is different to Classic: it is the sandbox proxy that calls back
into userd. Even if a session bus is running and a confined app could
call userd, userd will report an error because the caller is not confined
Package
Source: snapd (LP Ubuntu Debian)
Upstream:released (2.45.2)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (2.45.1ubuntu0.2)
Ubuntu 18.04 LTS (Bionic Beaver):released (2.45.1+18.04.2)
Ubuntu 20.04 LTS (Focal Fossa):released (2.45.1+20.04.2)
Ubuntu 20.10 (Groovy Gorilla):pending (2.46~pre1.gitaf15176)
Patches:
Upstream:https://github.com/snapcore/snapd/commit/06342a31878f1cf99d56da5483e71b9af61f46ad
More Information

Updated: 2020-08-07 15:14:22 UTC (commit 149fd68136588b2e7eebfd86d2f938e3dc212817)