USN-5292-1: snapd Ubuntu

Vulnerability summary

USN-5292-1 is a vulnerability in snapd Ubuntu with no CVSS score yet.

Timeline

1. 17-02-2022
   PublishedVulnerability first disclosed.
2. 10-02-2026
   Last modifiedVulnerability information updated.

Description

snapd vulnerabilities James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information. (CVE-2021-3155) Ian Johnson discovered that snapd did not properly validate content interfaces and layout paths. A local attacker could possibly use this issue to inject arbitrary AppArmor policy rules, resulting in a bypass of intended access restrictions. (CVE-2021-4120) The Qualys Research Team discovered that snapd did not properly validate the location of the snap-confine binary. A local attacker could possibly use this issue to execute other arbitrary binaries and escalate privileges. (CVE-2021-44730) The Qualys Research Team discovered that a race condition existed in the snapd snap-confine binary when preparing a private mount namespace for a snap. A local attacker could possibly use this issue to escalate privileges and execute arbitrary code. (CVE-2021-44731)

No weakness data has been published for this record.