Canonical’s Snap software packaging and deployment system are affected by multiple vulnerabilities, including a privilege escalation flaw tracked as CVE-2021-44731 (CVSS score 7.8).
Snap is a software packaging and deployment system developed by Canonical for operating systems that use the Linux kernel. The packages, called snaps, and the tool for using them, snapd, work across a range of Linux distributions
The flaws have been discovered by Qualys researchers, the CVE-2021-44731 is the most severe one and is a race condition in the snap-confine’s setup_private_mount() function.
The snap-confine is a program used internally by snapd to construct the execution environment for snap applications. An unprivileged user can trigger the flaw to gain root privileges on the affected host.
“Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.” reads the post published by the experts. “As soon as the Qualys Research Team confirmed the vulnerability, we engaged in responsible vulnerability disclosure and coordinated with both vendor and open-source distributions in announcing this newly discovered vulnerability.”
Qualys experts also developed a PoC exploit for this issue that allows obtaining full root privileges on default Ubuntu installations.
Below is the full list of vulnerabilities discovered by the experts:
| CVE | Description |
|---|---|
| CVE-2021-44731 | Race condition in snap-confine’s setup_private_mount() |
| CVE-2021-44730 | Hardlink attack in snap-confine’s sc_open_snapd_tool() |
| CVE-2021-3996 | Unauthorized unmount in util-linux’s libmount |
| CVE-2021-3995 | Unauthorized unmount in util-linux’s libmount |
| CVE-2021-3998 | Unexpected return value from glibc’s realpath() |
| CVE-2021-3999 | Off-by-one buffer overflow/underflow in glibc’s getcwd() |
| CVE-2021-3997 | Uncontrolled recursion in systemd’s systemd-tmpfiles |
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, CVE-2021-44731)
[adrotate banner=”5″]
[adrotate banner=”13″]
Fintech firm Figure confirmed a data breach after hackers used social engineering to trick an…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and…
A new alleged Russia-linked APT group targeted Ukrainian defense, government, and energy groups, with CANFAIL…
A new threat actor, UAT-9921, uses the modular VoidLink framework to target technology and financial…
Attackers quickly targeted BeyondTrust flaw CVE-2026-1731 after a PoC was released, enabling unauthenticated remote code…
Google says nation-state actors used Gemini AI for reconnaissance and attack support in cyber operations.…
This website uses cookies.