Vulnerability record · CVE-2019-7304 · published 23 April 2019
CVE-2019-7304: Canonical snapd socket owner validation flaw allows root command execution
Canonical · Snapd
Canonical snapd before 2.37.1 incorrectly validated socket ownership, letting an attacker run arbitrary commands as root. The flaw is an authorization error (CWE-863) in a service that ships with Ubuntu, so any host running an affected snapd build is exposed. It matters because it yields full root compromise with no credentials required.
Description
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code available, and very high EPSS probability make this an urgent root-compromise risk.
What it is
Canonical snapd before 2.37.1 incorrectly validated socket ownership, letting an attacker run arbitrary commands as root. The flaw is an authorization error (CWE-863) in a service that ships with Ubuntu, so any host running an affected snapd build is exposed. It matters because it yields full root compromise with no credentials required.
Impact
An attacker gains arbitrary command execution as root, giving complete control of the host, including data access, persistence and further lateral movement.
Attack surface
Reachable over the network per the CVSS vector (AV:N, PR:N, UI:N), meaning no authentication and no user interaction are needed. The description does not detail the exact socket interface, so the precise entry point is not specified in the record.
Exploitation
Public exploit code exists in Exploit-DB (references 46361 and 46362), and EPSS is 0.60813 (99.1st percentile), indicating high likelihood of exploitation. CISA KEV does not list it.
What to do
- Upgrade snapd to 2.37.1 or later, or apply the Ubuntu security update from USN-3887-1.
- Where immediate patching is not possible, restrict network access to snapd's socket and management interfaces to trusted local administration only.
- Audit hosts for snapd versions below 2.37.1 and prioritize internet-facing or multi-tenant systems.
- Monitor for unexpected root-level process creation or snapd-related activity after patch deployment.
Detection
- Alert on snapd processes spawning shells or unexpected child processes running as root.
- Monitor for connections to snapd sockets from non-local or untrusted sources.
- Hunt for known Exploit-DB 46361/46362 payload patterns or related command lines in process telemetry.
- Track snapd version inventory and flag any host still below 2.37.1.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://usn.ubuntu.com/3887-1/ | Vendor Advisory |
| https://www.exploit-db.com/exploits/46361 | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/46362 | ExploitThird Party AdvisoryVDB Entry |
| https://usn.ubuntu.com/3887-1/ | Vendor Advisory |
| https://www.exploit-db.com/exploits/46361 | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/46362 | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2019-7304 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-7304), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
