snapd 2.54.2 and previous versions created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local malicious user to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
canonical snapd |
||
canonical ubuntu linux 18.04 |
||
canonical ubuntu linux 20.04 |
||
canonical ubuntu linux 21.10 |
Get our weekly newsletter Or you could think of them as a superuser password reset function
The snap-confine tool in the Linux world's Snap software packaging system can be potentially exploited by ordinary users to gain root powers, says Qualys. Snap was developed by Ubuntu maker Canonical, and can be used with Ubuntu and on other Linux distributions, if one so wishes, to install applications and services. According to infosec biz Qualys, which found and reported the security shortcomings, there are two ways Snap's internal program snap-confine can be exploited to gain superuser privi...
Vulmon