Cloudanix VulnDB

CVE-2016-1580

Critical · 9.8

CVSS

9.8

EPSS

3.5%

Published

May 13, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A long-fixed flaw in how certain Ubuntu systems handled application packages could have let attackers read private files or take over the computer by using a package with a specially chosen name.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Privilege Gain
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The setup_snappy_os_mounts function improperly resolves bind mount points for snaps whose names begin with the ubuntu-core. prefix, enabling path traversal that exposes arbitrary files or grants elevated privileges.

Why it matters to the business

Attackers could read sensitive system data or obtain full control over affected Ubuntu systems, risking data breaches and operational disruption; the vulnerability is over ten years old with stable low exploitation probability and no known ransomware use, so impact is largely limited to unpatched legacy deployments.

How an attack unfolds

An attacker creates a snap package whose name starts with ubuntu-core., causes the target to install or mount it, and the flawed mount logic allows traversal outside the intended snap directory to read files or escalate privileges.

How to fix it

Upgrade the ubuntu-core-launcher package to version 1.0.27.1 or later; remove any untrusted snaps whose names start with ubuntu-core.; enforce strict snap naming and installation policies.

How to confirm the fix worked

Query the installed package version with dpkg or apt to confirm 1.0.27.1 or newer; attempt to install a test snap prefixed with ubuntu-core. and verify that mount points remain confined to expected directories.

Typical attack path

  1. Create a snap package whose name begins with the ubuntu-core. prefix
  2. Distribute the snap to the target Ubuntu system
  3. Trigger snap installation or mount via ubuntu-core-launcher
  4. Exploit the incorrect mount point calculation to traverse to sensitive paths
  5. Read confidential data or execute code with elevated privileges

How to detect it

Search system and snapd logs for mount operations or snap installations involving names that start with ubuntu-core.; inspect mount tables and file-access logs for unexpected traversals after snap activity.

  • snap name starting with ubuntu-core.
  • setup_snappy_os_mounts
  • bind mount outside expected snap directory

What your security team should do

  • Upgrade ubuntu-core-launcher to 1.0.27.1 or later on all systems
  • Audit existing snap packages for names beginning with ubuntu-core.
  • Block or review installation of snaps from untrusted sources
  • Monitor package update channels for any remaining legacy instances

The record

The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with "ubuntu-core."

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS ubuntu-core-launcher 0 1.0.27.1

Related vulnerabilities