PatchTheCVECVE-2020-11933: cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on ev
CVE-2020-11933 is a high-severity flaw (CVSS 7.3) affecting snapd, ubuntu linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version
Why this priority
- High severity
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-264 |
| Published | 2020-07-29 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11933?
snapd: upgrade to 2.45.2; ubuntu linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-11933 being exploited?
CVE-2020-11933 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11933 affect?
CVE-2020-11933 affects snapd, ubuntu linux. Severity is high (CVSS 7.3). cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitra
How urgent is CVE-2020-11933?
Priority 34/100. High severity; On your watchlist
Software pages
Related CVEs
- CVE-2024-5138 HIGH 8.1 UPGRADE The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain pr
- CVE-2024-29069 MEDIUM 4.8 UPGRADE In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extract
- CVE-2024-29068 MEDIUM 5.8 UPGRADE In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap
- CVE-2024-1724 MEDIUM 6.3 UPGRADE In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to
- CVE-2023-1523 CRITICAL 10.0 UPGRADE MITIGATE Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling te