CVE-2020-27352

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-21 · updated 2026-06-17
Weakness: CWE-269

Description

When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.

Affected products

Canonical Ltd. snapd: before 2.48.3 — fixed in 2.48.3
Canonical Ubuntu Linux: 16.04, 18.04, 20.04, 20.10

How to fix

Upgrade to a fixed version: Canonical Ltd. snapd 2.48.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-27352 or the next vulnerability affects your stack