CVE-2020-11933

Name: CVE-2020-11933
Creator: NVD / NIST
Published: 2020-07-29T17:15:12.857+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.8/10EPSS 0.22%

Last modified Jun 17, 2026

CVE-2020-11933 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.

Metrics

CVSS 3.1

6.8/10

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.22%

12.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-264

Affected Software

Vendor	Product	Versions
Canonical	Snapd	< 2.45.2
Canonical	Ubuntu Linux	16.04
Canonical	Ubuntu Linux	18.04
Canonical	Ubuntu Linux	19.10
Canonical	Ubuntu Linux	20.04

References

https://launchpad.net/bugs/1879530Third Party Advisory
https://ubuntu.com/USN-4424-1Vendor Advisory
https://launchpad.net/bugs/1879530Third Party Advisory
https://ubuntu.com/USN-4424-1Vendor Advisory

Timeline

Published: Jul 29, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-11933?

How severe is CVE-2020-11933?

CVE-2020-11933 has a CVSS score of 6.8/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2020-11933?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-11933?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST