CVE-2021-44731

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 18-02-2022 12:15

Last modified: - 01-03-2022 05:56

Total changes: - 6

Description

A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

High

Attack complexity

Local

Attack vector

High

Availability

High

Confidentiality

High

Integrity

Low

Privileges required

Changed

Scope

None

User interaction

7.8

Base score

1.1

6.0

Exploitability score

Impact score

Verification logic

vendor=canonical AND product=snapd AND versionEndIncluding=2.54.2

vendor=canonical AND product=ubuntu_linux AND version=18.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=20.04 AND software_edition=lts

vendor=canonical AND product=ubuntu_linux AND version=21.10

vendor=fedoraproject AND product=fedora AND version=34

vendor=fedoraproject AND product=fedora AND version=35

vendor=Debian AND product=debian_linux AND version=10.0

vendor=Debian AND product=debian_linux AND version=11.0

Reference

https://ubuntu.com/security/notices/USN-5292-1
[oss-security] 20220218 CVE-2021-4120: Insufficient validation of snap content interface and layout paths-Mailing List, Third Party Advisory
FEDORA-2022-5df8b52ba4-Mailing List, Third Party Advisory
FEDORA-2022-82bea71e5a-Mailing List, Third Party Advisory
DSA-5080-Issue Tracking, Third Party Advisory
[oss-security] 20220223 Re: CVE-2021-44731: Race condition in snap-confine's setup_private_mount()-Mailing List, Third Party Advisory
[oss-security] 20220223 Re: CVE-2021-44731: Race condition in snap-confine's setup_private_mount()-Mailing List, Third Party Advisory

Keywords

CVE-2021-44731

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2021-44731

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures