CVE-2021-44731highCWE-362

CVE-2021-44731: falha de alta gravidade em Canonical Ltd. snapd

snapd could be made to escalate privileges and run programs as administrator

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar snapd+ Monitorar snapd

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 1.0%
A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Canonical Ltd. · snapd
CVEs relacionadas — Canonical Ltd. snapd

No mesmo produto, das mais perigosas para as menos.

CVE-2023-1523CRITICALCVE-2023-1523EPSS 1.4%CVE-2024-5138HIGHCVE-2024-5138EPSS 0.8%CVE-2021-4120HIGHsnapd could be made to bypass intended access restrictions through snap content interfaces and layout pathsEPSS 0.4%CVE-2022-3328HIGHCVE-2022-3328EPSS 0.4%CVE-2021-44730HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 0.4%CVE-2021-3155LOWsnapd created ~/snap with too-wide permissionsEPSS 0.3%