CVE-2024-5138: Canonical Snapd Privilege Escalation Flaw

CVE-2024-5138 Overview

CVE-2024-5138 is an input validation flaw [CWE-20] in Canonical's snapd package manager. The snapctl component fails to properly parse command-line arguments when determining whether a caller is authorized to run privileged operations. An unprivileged user inside a confined snap can craft argument vectors that trick snapctl into executing actions normally restricted to root, on behalf of the snap. Successful exploitation can trigger denial of service or other privileged operations against the snapd daemon.

Critical Impact
Unprivileged local users can invoke privileged snapctl subcommands against the snapd daemon, enabling denial of service and unauthorized administrative actions on affected Linux systems.

Affected Products

Canonical snapd (versions prior to the fix in commit 68ee9c6a)
Ubuntu distributions shipping vulnerable snapd builds
Any Linux distribution using upstream snapd for snap package management

Discovery Timeline

2024-05-31 - CVE-2024-5138 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5138

Vulnerability Analysis

The snapctl binary is the bridge between a confined snap and the snapd daemon. It exposes subcommands that snaps use to read configuration, manage services, and request privileged actions. To decide whether a caller is authorized, snapctl inspects the argument list and matches the requested subcommand against an allowlist named nonRootAllowed.

The original authorization logic in overlord/hookstate/ctlcmd/ctlcmd.go used strutil.ListContains(nonRootAllowed, args[0]) to check the first argument. However, it also permitted execution when -h or --help appeared anywhere in the argument list. This loose check let an attacker place a privileged subcommand as args[0] and append --help later in the vector to satisfy the allow condition, bypassing the intended root-only restriction.

Root Cause

The root cause is improper input validation [CWE-20] in the isAllowedToRun function. Authorization decisions were made against unstructured argument slices without positional or semantic parsing. A single --help token anywhere in the arguments short-circuited the check, regardless of the actual subcommand being invoked.

Attack Vector

An attacker with control over a confined snap, or an unprivileged local user who can invoke snapctl inside a snap context, constructs an argument vector combining a privileged subcommand with a permissive flag. snapctl forwards the request to the snapd daemon, which executes the action with elevated authority.

// Security patch in overlord/hookstate/ctlcmd/ctlcmd.go
// Merge pull request from GHSA-p9v8-q5m4-pf46

// isAllowedToRun returns true if the user with the given UID can run the given snapctl command vector.
//
// Commands still need valid context and snaps can only access own config.
func isAllowedToRun(uid uint32, args []string) bool {
	// Root can run all snapctl commands.
	if uid == 0 {
		return true
	}

	for idx, arg := range args {
		// A number of sub-commands are allowed to be executed by non-root users.
		if idx == 0 && strutil.ListContains(nonRootAllowed, arg) {
			return true
		}

		// Invoking help is always allowed.
		if arg == "-h" || arg == "--help" {
			return true
		}
	}
	return false
}

Source: snapd commit 68ee9c6a. The patch replaces the loose ListContains check with positional parsing: only args[0] is validated against nonRootAllowed, and help flags no longer act as blanket bypasses for privileged subcommands.

Detection Methods for CVE-2024-5138

Indicators of Compromise

Unexpected snapctl invocations from confined snaps combining privileged subcommands with -h or --help flags in non-leading argument positions.
snapd daemon audit entries showing privileged actions executed on behalf of snaps run by unprivileged UIDs.
Unexplained service restarts, configuration changes, or refresh operations triggered through the snap hook interface.

Detection Strategies

Audit snapd and snapctl process telemetry for argument patterns that mix privileged subcommands with help flags.
Correlate snap hook execution with the invoking UID and flag any non-root invocations of restricted subcommands.
Baseline installed snapd versions across the Linux fleet and identify hosts running builds prior to the fixed release.

Monitoring Recommendations

Ingest journalctl -u snapd logs into a centralized data lake to retain full command-line context for snapctl calls.
Alert on process-exec events where snapctl is the child of a confined snap and its argument vector contains both an admin subcommand and --help.
Track file integrity of /usr/bin/snapctl and the snapd binary to detect unauthorized replacement or downgrade.

How to Mitigate CVE-2024-5138

Immediate Actions Required

Update snapd to a version that includes commit 68ee9c6a from the snapcore/snapd repository.
Inventory all Linux hosts running snapd and prioritize multi-user systems where untrusted users can install or run snaps.
Review installed snaps for unexpected hooks or services that could be leveraged to invoke snapctl with crafted arguments.

Patch Information

Canonical fixed the flaw upstream via commit 68ee9c6aa916ab87dbfd9a26030690f2cabf1e14, referenced in GitHub Security Advisory GHSA-p9v8-q5m4-pf46 and tracked in Launchpad bug 2065077. The patch enforces positional validation of snapctl arguments and removes the help-flag bypass. Apply distribution updates via apt update && apt install snapd on Ubuntu and equivalent commands on other distributions.

Workarounds

Restrict interactive shell access to hosts running vulnerable snapd builds until patches can be applied.
Remove or disable non-essential snaps that expose hooks callable by unprivileged users.
Monitor snapctl invocations with auditd rules to detect suspicious argument patterns while patching is pending.

bash

# Update snapd on Ubuntu/Debian systems
sudo apt update
sudo apt install --only-upgrade snapd
sudo systemctl restart snapd
snap version

# Auditd rule to log snapctl execution
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/snapctl -k snapctl_exec