snapd could be made to escalate privileges and run programs as administrator

snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

在文件访问前对链接解析不恰当(链接跟随)

snapd 后置链接漏洞

snapd是开源的一个跨平台的包管理工具。 snapd 2.54.2 版本存在后置链接漏洞，该漏洞源于没有正确验证snap- restricted二进制文件的位置。本地攻击者可利用该漏洞，可以将这个二进制文件硬链接到另一个位置，从而导致snap-限制执行其他任意二进制文件，从而获得特权升级。

N/A

N/A