VYPR
← All advisories
High severity7.3NVD Advisory· Published Jul 29, 2020· Updated Jun 17, 2026

CVE-2020-11933

CVE-2020-11933

Description

cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • Canonical/Snapd2 versions
    cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:canonical:snapd:*:*:*:*:*:*:*:*range: <2.45.2
    • (no CPE)range: 2.45.2
  • Canonical/Ubuntu Linux4 versions
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
  • snapd/cloud-initllm-create
    Range: <2.45.2 revision 8539
  • Ubuntu/Ubuntu Corellm-create
    Range: 16, 18
  • Canonical/corev5
    Range: 2.45.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.