CVE-2024-5300
Received Received - Intake

Access Control Bypass and Information Disclosure in snapd

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Canonical Ltd.

Description
An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2024-5300
EUVD
EUVD-2024-55693

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
canonical snapd *
canonical snapd to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-212 The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an access control bypass and information disclosure flaw in Canonical snapd's AppArmor security profile. It allows strictly confined snap applications, even those running as restricted root within a sandbox, to interact with systemd-userdbd UNIX domain sockets. This lets them query and retrieve all system password hashes from /etc/shadow, bypassing intended sandbox restrictions.

Detection Guidance

Check if systemd-userdbd is installed and running using systemctl list-units --type=service | grep systemd-userdbd. Inspect AppArmor profiles for snapd with sudo apparmor_status and review /etc/apparmor.d/abstractions/nss-systemd for io.systemd.Multiplexer or io.systemd.NameServiceSwitch socket access.

Impact Analysis

If exploited, this vulnerability could allow a malicious or compromised snap application to obtain all system password hashes. This could lead to unauthorized access to sensitive accounts if passwords are cracked. However, exploitation requires a snap application already running as root within the sandbox.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, potentially violating data protection requirements under GDPR and HIPAA. Exposure of password hashes may constitute a data breach, requiring notification and remediation under these regulations.

Mitigation Strategies

Remove systemd-userdbd if installed with sudo apt remove systemd-userdbd. Update snapd and AppArmor profiles via sudo apt update && sudo apt upgrade. Restrict snap root access and review snap confinement policies. Monitor for unauthorized access to /run/systemd/userdb/

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-5300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart