CVE-2020-27352 is a high-severity vulnerability affecting Canonical snapd and Ubuntu Linux, where snapd fails to specify Delegate=yes when generating systemd service units for snaps like Docker. This oversight can lead to systemd moving container processes into the main snap daemon's cgroup during unit reloads, potentially granting unintended elevated privileges to containers. With a CVSS score of 8.8 (HIGH), it represents a local attack vector with low complexity, allowing for significant confidentiality, integrity, and availability impacts. While no active exploitation, public exploit code, or significant community discussion has been observed, the potential for privilege escalation within affected systems remains a concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.48.3CPE matchmatch criteria | cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
20.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | ||
20.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.