Summary
The Qualys Research Team discovered that a race condition existed in the
snapd snap-confine binary when preparing the private /tmp mount for a
snap. A local attacker could possibly use this issue to escalate privileges
and execute arbitrary code.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | snapd | 2.57.5+18.04ubuntu0.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | snapd | 2.57.5+20.04ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | snapd | 2.57.5+22.04ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | snapd | 2.54.3+16.04.0ubuntu0.1~esm5 |
Vulnerabilities 1
-
High 7.8CVE-2022-3328 Public exploit
snapd Race Condition vulnerability
Race condition in snap-confine's must_mkdir_and_open_with_perms()
References
-
report
https://ubuntu.com/security/CVE-2022-3328