snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: canonical
Published: 2022-02-17T22:15:18
Updated: 2024-08-04T04:32:12.268Z
Reserved: 2021-12-08T00:00:00
Link: CVE-2021-44730
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-02-17T23:15:07.413
Modified: 2024-11-21T06:31:28.040
Link: CVE-2021-44730
Redhat
No data.