A Qualys company has identified a vulnerability (CVE-2026-3888) in the operation of the snap-confine and systemd-tmpfiles interaction in Ubuntu, allowing an unprivileged user to gain root access to the system. The issue is present in Ubuntu with the default configuration starting from release 24.04. In Ubuntu 16.04-22.04, the vulnerability can be exploited in non-standard configurations that mimic the behavior of newer versions of the distribution. A fix is available in yesterday's update of the snapd package in Ubuntu. The issue has been resolved in snapd version 2.75. <\/p>\n
The vulnerability arises from incorrect interaction between the snap-confine and systemd-tmpfiles utilities, which are executed with elevated privileges. The snap-confine utility creates a sandbox environment for running the snap application, while systemd-tmpfiles performs automatic cleanup of temporary files and directories. By default, systemd-tmpfiles is configured to remove all old files and directories in \/tmp, which can be exploited by an attacker to replace the \/tmp\/.snap directory after its deletion by systemd-tmpfiles, but before it is recreated by snap-confine. <\/p>\n
A t\u00e1mad\u00e1s l\u00e9nyege, hogy a folyamatot v\u00e1rakoztatva indul el a ideiglenes f\u00e1jlok tiszt\u00edt\u00e1s\u00e1ra, a \/tmp\/.snap k\u00f6nyvt\u00e1r \u00e1t\u00edr\u00e1s\u00e1val a t\u00f6rl\u00e9s ut\u00e1n, \u00e9s a m\u00f3dos\u00edtott m\u00e1solatok elhelyez\u00e9s\u00e9vel a \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange k\u00f6nyvt\u00e1rban. A t\u00e1mad\u00f3nak t\u00f6bb nap v\u00e1rakoz\u00e1sra lehet sz\u00fcks\u00e9ge a systemd-tmpfiles ind\u00edt\u00e1s\u00e1hoz, mivel az Ubuntu 24.04 eset\u00e9n a tiszt\u00edt\u00e1si folyamat 10 naponta, m\u00edg az \u00fajabb kiad\u00e1sokban 30 naponta indul el. A k\u00f6nyvt\u00e1r \u00e1t\u00edr\u00e1s\u00e1t k\u00f6vet\u0151en a t\u00e1mad\u00f3 \u00faj sandbox-k\u00f6rnyezetet inicializ\u00e1l a snap-confine seg\u00edts\u00e9g\u00e9vel. <\/p>\n
During the preparation of the sandbox environment in the temporary directory \/tmp\/.snap, the attacker waits for the right moment and renames \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange to \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu, thus replacing the libraries and ensuring their bind mount with root privileges. In this way, the attacker gains control over the shared libraries and the loader ld.so used in the snap sandbox environment, and can execute arbitrary code with root privileges by launching any SUID program that utilizes dynamic linking. <\/p>\n
Root-hozz\u00e1f\u00e9r\u00e9ssel a sandbox-k\u00f6rnyezetben, amely az AppArmor seg\u00edts\u00e9g\u00e9vel van elszigetelve \u00e9s a seccomp alap\u00fa rendszerh\u00edv\u00e1s-sz\u0171r\u0151n kereszt\u00fcl, a t\u00e1mad\u00f3 lem\u00e1solhatja a \/bin\/bash-t a \/var\/snap\/$SNAP\/common\/ k\u00f6nyvt\u00e1rba, \u00e9s be\u00e1ll\u00edthatja a '04755' (suid root) jogokat. Annak ellen\u00e9re, hogy a jogok a sandbox-k\u00f6rnyezeten bel\u00fcl m\u00f3dosultak, a m\u00f3dos\u00edtott jogokkal rendelkez\u0151 f\u00e1jl az alap rendszeren is el\u00e9rhet\u0151, ez\u00e9rt a teljes root hozz\u00e1f\u00e9r\u00e9shez elegend\u0151, ha egy nem privil\u00e9giz\u00e1lt felhaszn\u00e1l\u00f3 a \/var\/snap\/\/common\/bash-t futtatja a norm\u00e1l rendszerk\u00f6rnyezetb\u0151l. <\/p>\n
At the same time, a vulnerability was discovered in the uutils coreutils (Rust Coreutils) toolkit, an analogue of the GNU Coreutils package written in Rust. The vulnerability allows an unprivileged user to gain root rights in the system. The issue was identified during the review of changes in Ubuntu 25.10 and was mitigated in a workaround prior to the release of Ubuntu 25.10 by providing \/usr\/bin\/gnurm instead of uutils rm. In the uutils package, the problem was fixed in the uutils coreutils 0.3.0 release, without a mention in the changelog regarding the vulnerability fix (it was noted that a safe method for bypassing paths was implemented in rm, du, chmod, and chgrp). <\/p>\n
A probl\u00e9ma egy versenyhelyzetb\u0151l ad\u00f3dik a 'rm' parancsban, amely lehet\u0151v\u00e9 teszi a helyi felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra, hogy a folyamat v\u00e9grehajt\u00e1sakor a 'rm' parancs \u00e1ltal kezelt f\u00e1jl tartalm\u00e1t egy szimbolikus linkre cser\u00e9lje, mik\u00f6zben az adott f\u00e1jl t\u00f6rl\u00e9se root jogokkal t\u00f6rt\u00e9nik. Egyebek k\u00f6z\u00f6tt a sebezhet\u0151s\u00e9g napi ciklusban kihaszn\u00e1lhat\u00f3 a cron-b\u00f3l val\u00f3 futtat\u00e1s sor\u00e1n, amely az \/etc\/cron.daily\/apport alatt tal\u00e1lhat\u00f3, root jogokkal fut, \u00e9s rekurz\u00edvan t\u00f6rli a \/var\/crash k\u00f6nyvt\u00e1r tartalm\u00e1t, amely minden felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra \u00edrhat\u00f3 a rendszerben. <\/p>\n