CVE-2020-27352: 
Linux Debian vulnerability analysis and mitigation

When generating the systemd service units for the docker snap (and other similar snaps), snapd did not specify Delegate=yes - as a result systemd would move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This vulnerability was assigned CVE-2020-27352 and affects container management snaps such as Docker, Microk8s, Azure IoT Edge, and AWS IoT Greengrass (NVD, Ubuntu Security).

The vulnerability stems from snapd's failure to include the Delegate=yes directive in systemd service units for container management snaps. This configuration issue allows systemd to move container processes back into the same control group as the parent process (dockerd) during system unit reloads. The vulnerability has been assigned a CVSS v3.1 base score of 9.3 CRITICAL with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD).

This vulnerability could allow containers within affected snaps to gain additional privileges that were not originally intended. Specifically, after a systemctl daemon-reload is executed, docker containers would have the same privilege level as dockerd, resulting in a privilege escalation. This affects any snap which has been granted privilege to use container management interfaces (Launchpad Bug).

The vulnerability can be triggered when system units are reloaded, and does not require administrative intervention to be exploited. The issue affects container management snaps that use privileged interfaces such as docker-support, kubernetes-support, and greengrass-support (Launchpad Bug).

The issue was fixed in snapd version 2.48.3. After updating, snapd will automatically refresh itself to the unaffected version. Affected container management snaps will also automatically refresh, which will restart containers and resolve the vulnerability. The fix involves adding Delegate=true to the systemd service units for snaps that use container management interfaces (Ubuntu Security).