Tvrtka Qualys otkrila je ranjivost (CVE-2026-3888) u na\u010dinu rada paketa snap-confine i systemd-tmpfiles na Ubuntuu, koja omogu\u0107ava neprivilegiranom korisniku da dobije root pristup sustavu. Problem se pojavljuje na Ubuntuu u zadanoj konfiguraciji od verzije 24.04. Na Ubuntuu 16.04-22.04 ranjivost se mo\u017ee iskoristiti u nestandardnim konfiguracijama koje opona\u0161aju pona\u0161anje novijih verzija distribucije. Na Ubuntuu je ispravak dostupan u ju\u010dera\u0161njem a\u017euriranju paketa snapd. U snapd problem je rije\u0161en u a\u017euriranju 2.75. <\/p>\n
Ranjivost nastaje uslijed nepravilne interakcije alata snap-confine i systemd-tmpfiles, koji se izvr\u0161avaju s povi\u0161enim privilegijama. Alat snap-confine stvara sandbox okru\u017eenje za izvr\u0161avanje snap aplikacija, dok systemd-tmpfiles provodi automatsko \u010di\u0161\u0107enje privremenih datoteka i direktorija. Po zadanim postavkama, alat systemd-tmpfiles pode\u0161en je za brisanje svih starih datoteka i direktorija u \/tmp, \u0161to mo\u017ee iskoristiti napada\u010d za zamjenu direktorija \/tmp\/.snap u trenutku nakon njegovog brisanja od strane alata systemd-tmpfiles, ali prije ponovnog kreiranja od strane snap-confine. <\/p>\n
Napad se svodi na \u010dekanje pokretanja procesa \u010di\u0161\u0107enja privremenih datoteka, zamjene direktorija \/tmp\/.snap nakon njegovog brisanja i postavljanja modifikirane kopije biblioteka \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange. Napada\u010du mo\u017ee trebati nekoliko dana \u010dekanja na pokretanje systemd-tmpfiles-a, budu\u0107i da se u Ubuntu 24.04 proces \u010di\u0161\u0107enja pokre\u0107e jednom svake 10 dana, dok se u novijim izdanjima pokre\u0107e jednom svake 30 dana. Nakon zamjene direktorija, napada\u010d posti\u017ee inicijalizaciju novog sandbox-okru\u017eenja pomo\u0107u snap-confine. <\/p>\n
Prilikom stvaranja sadr\u017eaja sandbox okru\u017eenja u privremenom direktoriju \/tmp\/.snap napada\u010d \u010deka pravi trenutak i preimenuje \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange u \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu, na taj na\u010din zamjenjuju\u0107i biblioteke i osiguravaju\u0107i njihovo bind-montiranje s root pravima. Na taj na\u010din napada\u010d dobiva kontrolu nad zajedni\u010dkim bibliotekama i u\u010ditava\u010dem ld.so, koji se pokre\u0107u u sandbox okru\u017eenju snap, i mo\u017ee posti\u0107i izvr\u0161avanje proizvoljnog koda s root pravima pokretanjem bilo kojeg suid programa u kojem se primjenjuje dinami\u010dko povezivanje. <\/p>\n
Imaju\u0107i root pristup u sandbox-okru\u017eenju, koje je izolirano putem AppArmor-a i filtra sistemskih poziva temeljenog na seccomp-u, napada\u010d mo\u017ee kopirati \/bin\/bash u direktorij \/var\/snap\/$SNAP\/common\/ i postaviti mu prava \u00ab04755\u00bb (suid root). Iako su prava promijenjena unutar sandbox-okru\u017eenja, datoteka s izmijenjenim pravima dostupna je i u glavnom sustavu, pa je za dobivanje punog root pristupa dovoljno pokrenuti \/var\/snap\/\/common\/bash kao obi\u010dan nepriviligirani korisnik iz standardnog sistemskog okru\u017eenja. <\/p>\n
Prilikom toga otkrivena je ranjivost u alatima uutils coreutils (Rust Coreutils), ekvivalentu paketa GNU Coreutils, napisanom na jeziku Rust. Ranjivost omogu\u0107ava neprivilegiranom korisniku da dobije root prava u sustavu. Problem je otkriven tijekom recenzije promjena u Ubuntu 25.10 i zaobi\u0111en do objavljivanja Ubuntu 25.10 isporukom \/usr\/bin\/gnurm umjesto uutils rm. U paketu uutils problem je otklonjen u izdanju uutils coreutils 0.3.0, bez naznake u popisu promjena o otklanjanju ranjivosti (navedeno je da je u rm, du, chmod i chgrp implementirana sigurna metoda za zaobila\u017eenje putanja). <\/p>\n
Problem je uzrokovan stanjem utrke u alatu \u00abrm\u00bb, \u0161to omogu\u0107ava lokalnom korisniku da zamijeni sadr\u017eaj direktorija sa simboli\u010dkom vezom tijekom brisanja datoteke pod kontrolom korisnika procesom \u00abrm\u00bb s pravima root. Izme\u0111u ostalog, ranjivost se mo\u017ee iskoristiti tijekom svakodnevnog pokretanja iz cron skripte \/etc\/cron.daily\/apport, koja se pokre\u0107e s pravima root i rekurzivno bri\u0161e sadr\u017eaj direktorija \/var\/crash, dostupnog za pisanje svim korisnicima u sustavu. <\/p>\n
Tijekom rekurzivnog brisanja direktorija alat rm najprije provjerava sve direktorije, a zatim ih sequentialno uklanja u obrnutom redoslijedu, pozivaju\u0107i funkciju rmdir(). Ako se postigne zamjena roditeljskog direktorija simboli\u010dkom vezom odmah nakon provjere tog direktorija, ali prije provjere ugnije\u017e\u0111enih poddirektorija, operacija \u0107e rezultirati brisanjem direktorija na koji upu\u0107uje simboli\u010dka veza. Na taj na\u010din se mo\u017ee posti\u0107i ne samo brisanje bilo koje datoteke u sustavu, ve\u0107 i podizanje privilegija kroz brisanje direktorija \/tmp\/snap-private-tmp\/$SNAP\/tmp\/.snap kako bi se zamijenilo sadr\u017eaj sandbox okru\u017eenja snap paketa (metoda dobivanja root prava sli\u010dna je prvoj ranjivosti). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 Ubuntu \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 24.04. \u0412 Ubuntu 16.04-22.04 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u0412 Ubuntu \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165172","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Ranjivosti u snapd i Rust Coreutils, koje omogu\u0107uju dobivanje root privilegija na Ubuntuu | ProHoster","description":"Tvrtka Qualys otkrila je ranjivost (CVE-2026-3888) u radu kombinacije snap-confine i systemd-tmpfiles na Ubuntuu, koja omogu\u0107ava neprivilegiranom korisniku da dobije root-pristup sustavu.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 snapd \u0438 Rust \u0421oreutils, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 Ubuntu | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-18T15:12:13+00:00","article:modified_time":"2026-03-18T15:12:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/165172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=165172"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/165172\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=165172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=165172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=165172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"