CVE-2024-29068

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

• CWE-20

• https://github.com/snapcore/snapd/commit/b66fee81606a1c05f965a876ccbaf44174194063Patch
• https://github.com/snapcore/snapd/pull/13682Issue Tracking, Patch
• https://github.com/snapcore/snapd/commit/b66fee81606a1c05f965a876ccbaf44174194063Patch
• https://github.com/snapcore/snapd/pull/13682Issue Tracking, Patch

Published

Jul 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29060Visual Studio Elevation of Privilege Vulnerability6.7
• CVE-2024-29061Secure Boot Security Feature Bypass Vulnerability7.8
• CVE-2024-29062Secure Boot Security Feature Bypass Vulnerability7.1
• CVE-2024-29063Azure AI Search Information Disclosure Vulnerability5.5
• CVE-2024-29064Windows Hyper-V Denial of Service Vulnerability5.5
• CVE-2024-29066Windows Distributed File System (DFS) Remote Code Execution …7.2
• CVE-2024-29069In snapd versions prior to 2.62, snapd failed to properly ch…7.3
• CVE-2024-2907The AGCA WordPress plugin before 7.2.2 does not sanitise an…6.8
• CVE-2024-29070On versions before 2.1.4, session is not invalidated after l…9.1
• CVE-2024-29071HGW BL1500HM Ver 002.001.013 and earlier contains a use of w…8.8
• CVE-2024-29072A privilege escalation vulnerability exists in the Foxit Rea…8.2
• CVE-2024-29073An vulnerability in the handling of Latex exists in Ankitect…6.5