9 results · Clear filters · Feed
-
High 7.8CVE-2026-8933 Public exploit
snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-c…
-
High 8.4
snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process ope…
-
High 7.8CVE-2026-3888 Public exploit
Local Privilege Escalation in snapd
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS…
-
High 8.1
CVE-2024-5138: snapd snapctl auth bypass
The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to tri…
-
High 7.8CVE-2022-3328 Public exploit
snapd Race Condition vulnerability
Race condition in snap-confine's must_mkdir_and_open_with_perms()
-
High 8.2
snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths
snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap c…
-
High 7.8
snapd could be made to escalate privileges and run programs as administrator
snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd ver…
-
High 7.8CVE-2021-44731 Public exploit
snapd could be made to escalate privileges and run programs as administrator
A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and c…
-
High 8.8
Local privilege escalation via snapd socket
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.