CVE-2020-27352
📋 TL;DR
A privilege escalation vulnerability in snapd's systemd service unit generation allows Docker containers within snaps to gain unintended privileges. When systemd reloads units without Delegate=yes, container processes can be moved into the main snap daemon's cgroup. This affects systems running Docker or similar container snaps via snapd.
💻 Affected Systems
- snapd
- docker snap
- similar container snaps
📦 What is this software?
Snapd by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Container breakout leading to full host compromise, allowing attackers to execute arbitrary code with root privileges on the underlying system.
Likely Case
Container privilege escalation enabling unauthorized access to host resources, potentially compromising other containers or services.
If Mitigated
Limited impact with proper container isolation and security controls, though some privilege escalation risk remains.
🎯 Exploit Status
Exploitation requires access to a container within a vulnerable snap. Public proof-of-concept demonstrates the privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: snapd 2.48.1 and later
Vendor Advisory: https://ubuntu.com/security/notices/USN-4728-1
Restart Required: Yes
Instructions:
1. Update snapd: sudo snap refresh snapd
2. Update affected snaps: sudo snap refresh docker
3. Restart affected services: sudo systemctl restart snap.docker.dockerd
🔧 Temporary Workarounds
Disable affected snaps
linuxTemporarily disable Docker or other affected snaps until patched.
sudo snap disable docker
Use alternative Docker installation
linuxSwitch to Docker installed via apt or other package managers instead of snap.
sudo snap remove docker
sudo apt install docker.io
🧯 If You Can't Patch
- Implement strict container isolation policies and limit container capabilities.
- Monitor container behavior for privilege escalation attempts and restrict container-to-host interactions.
🔍 How to Verify
Check if Vulnerable:
Check snapd version: snap version | grep snapdCheck Version:
snap version | grep snapdVerify Fix Applied:
Verify snapd version is 2.48.1 or higher: snap version | grep snapd📡 Detection & Monitoring
Log Indicators:
- Unusual process movements between cgroups in systemd logs
- Container processes appearing in snap daemon cgroup
Network Indicators:
- Unexpected network connections from containers to host services
SIEM Query:
source="systemd" AND "cgroup" AND ("move" OR "delegate")