Linux Canonical Snap Manager Privilege escalation

Qualys researchers discovered a new Linux privilege escalation vulnerability, tracked as CVE-2021-44731, in Canonical’s Snap Package Manager.

Canonical’s Snap software packaging and deployment system are affected by multiple vulnerabilities, including a privilege escalation flaw tracked as CVE-2021-44731 with CVSS score 7.8.

Snap is a software packaging and deployment system developed by Canonical for operating systems that use the Linux kernel. The packages, called snaps, and the tool for using them, snapd, work across a range of Linux distributions

The flaws have been discovered by Qualys researchers, the CVE-2021-44731 is the most severe one and is a race condition in the snap-confine’s setup_private_mount() function.

The snap-confine is a program used internally by snapd to construct the execution environment for snap applications. An unprivileged user can trigger the flaw to gain root privileges on the affected host.

Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. 

Below are the vulnerabilities discovered

• CVE-2021-44731Race condition in snap-confine’s setup_private_mount()
• CVE-2021-44730Hardlink attack in snap-confine’s sc_open_snapd_tool()
• CVE-2021-3996Unauthorized unmount in util-linux’s libmount
• CVE-2021-3995Unauthorized unmount in util-linux’s libmountCVE-2021-3998Unexpected return value from glibc’s realpath()
• CVE-2021-3999Off-by-one buffer overflow/underflow in glibc’s getcwd()
• CVE-2021-3997Uncontrolled recursion in systemd’s systemd-tmpfiles