PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-5300 Canonical CVE debrief

An access control bypass and information disclosure vulnerability exists in Canonical snapd's base AppArmor security profile configuration. The issue allows strictly confined snap applications to interact with systemd's user database, potentially leading to unauthorized access to system password hashes. This vulnerability has specific conditions required for exploitation and is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments. System administrators should review the security notice provided by Canonical and assess the risk to their systems.

Vendor
Canonical
Product
Ubuntu 26.04 LTS
CVSS
MEDIUM 5.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

System administrators and users of Canonical's Ubuntu systems with snapd installed should be aware of this vulnerability. Although systemd-userdbd is not installed by default on standard Ubuntu deployments, systems with this service installed and operational are potentially affected. Operators and security teams should review the security notice provided by Canonical and assess the risk to their systems.

Technical summary

The vulnerability is caused by abstraction rules in /etc/apparmor.d/abstractions/nss-systemd that permit interactions with io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets. This allows strictly confined snap applications running as root to query the Varlink interface and retrieve all system password hashes, bypassing intended sandbox restrictions. The issue is specific to systems where the systemd-userdbd service is installed and operational.

Defensive priority

Medium priority due to the specific conditions required for exploitation and the limited scope of affected systems. However, given the potential for unauthorized access to system password hashes, this vulnerability should be addressed in a timely manner.

Recommended defensive actions

  • Review and update AppArmor security profiles to restrict access to sensitive systemd user database interfaces.
  • Verify that systemd-userdbd is not installed or is properly configured to restrict access.
  • Monitor snap applications and their interactions with system services.
  • Implement additional security measures to restrict root access within snap application sandboxes.
  • Perform a thorough review of the AppArmor security profile configuration and systemd-userdbd service to understand the full scope of the vulnerability.
  • Conduct a risk assessment to determine the potential impact on systems with snapd installed.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was disclosed through the CVE program. The NVD entry is currently Awaiting Analysis. Canonical has provided a reference to their security notice for this CVE. Further review of the AppArmor security profile configuration and systemd-userdbd service is necessary to understand the full scope of the vulnerability. Defenders should verify the presence of the systemd-userdbd service and review snap application interactions with system services.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T15:16:29.027Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.