Snapd

The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was found that snapctl did not properly parse command-line arguments, allowing an unprivileged user to trigger an authorised action on behalf of the snap that would normally require administrator privileges to perform. This could possibly allow an unprivileged user to perform a denial of service or similar.

Published: 2024-05-31T21:02:19.979Z
Updated: 2024-09-06T19:48:49.508Z

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others are not affected - this can only be exploited when snaps are run on a virtual console.

Published: 2023-09-01T18:41:47.820Z
Updated: 2024-10-01T13:08:45.851Z

Race condition in snap-confine's must_mkdir_and_open_with_perms()

Published: 2024-01-08T18:04:10.534Z
Updated: 2025-06-03T14:35:04.952Z

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Published: 2022-02-17T22:15:21.000Z
Updated: 2024-08-03T17:16:04.197Z

A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Published: 2022-02-17T00:00:00.000Z
Updated: 2024-08-04T04:32:12.887Z