Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7304
Reference (s):
- https://usn.ubuntu.com/3887-1/
- https://www.exploit-db.com/exploits/46361
- https://www.exploit-db.com/exploits/46362