Compania Qualys a identificat o vulnerabilitate (CVE-2026-3888) \u00een organizarea func\u021bion\u0103rii leg\u0103turii snap-confine \u0219i systemd-tmpfiles \u00een Ubuntu, care permite unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 acces root la sistem. Problema se manifest\u0103 \u00een Ubuntu \u00een configura\u021bia implicit\u0103 \u00eencep\u00e2nd cu versiunea 24.04. \u00cen Ubuntu 16.04-22.04, vulnerabilitatea poate fi exploatat\u0103 \u00een configura\u021bii non-standard care imit\u0103 comportamentul versiunilor mai noi ale distribu\u021biei. \u00cen Ubuntu, remedierile sunt disponibile \u00een actualizarea de ieri a pachetului snapd. \u00cen snapd, problema a fost solu\u021bionat\u0103 \u00een actualizarea 2.75. <\/p>\n
Vulnerabilitatea apare din cauza interac\u021biunii incorecte \u00eentre utilitarele snap-confine \u0219i systemd-tmpfiles, executate cu privilegii elevate. Utilitarul snap-confine creeaz\u0103 un mediu sandbox pentru execu\u021bia aplica\u021biilor snap, iar systemd-tmpfiles efectueaz\u0103 cur\u0103\u021barea automat\u0103 a fi\u0219ierelor \u0219i directoarelor temporare. \u00cen mod implicit, utilitarul systemd-tmpfiles este configurat s\u0103 elimine toate fi\u0219ierele \u0219i directoarele vechi din \/tmp, ceea ce poate fi folosit de atacatori pentru a \u00eenlocui directorul \/tmp\/.snap \u00een momentul dup\u0103 eliminarea sa de c\u0103tre utilitarul systemd-tmpfiles, dar \u00eenainte de recrearea sa de c\u0103tre snap-confine. <\/p>\n
Atacul const\u0103 \u00een a\u0219teptarea \u00eenceperii procesului de cur\u0103\u021bare a fi\u0219ierelor temporare, \u00eenlocuirea directorului \/tmp\/.snap dup\u0103 ce acesta a fost \u0219ters \u0219i plasarea unei copii modificate a bibliotecilor \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange. Atacatorului \u00eei pot fi necesare c\u00e2teva zile pentru a a\u0219tepta pornirea systemd-tmpfiles, deoarece \u00een Ubuntu 24.04 procesul de cur\u0103\u021bare porne\u0219te la fiecare 10 zile, iar \u00een versiuni mai recente \u2014 la fiecare 30 de zile. Dup\u0103 \u00eenlocuirea directorului, atacatorul reu\u0219e\u0219te ini\u021bializarea unui nou mediu sandbox prin intermediul snap-confine. <\/p>\n
\u00cen timpul form\u0103rii ambalajului mediu sandbox \u00een directorul temporar \/tmp\/.snap, atacatorul a\u0219teapt\u0103 momentul potrivit \u0219i redenume\u0219te \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange \u00een \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu, \u00eenlocuind astfel bibliotecile \u0219i asigur\u00e2nd montarea lor bind cu drepturi root. Astfel, atacatorul ob\u021bine control asupra bibliotecilor partajate \u0219i a \u00eenc\u0103rc\u0103torului ld.so, care sunt rulante \u00een mediul sandbox snap \u0219i poate ob\u021bine execu\u021bia de cod arbitrar cu privilegii root prin lansarea oric\u0103rei programe suid \u00een care se aplic\u0103 legarea dinamic\u0103. <\/p>\n
Av\u00e2nd acces root \u00een mediu sandbox, izolat prin AppArmor \u0219i un filtru de apeluri de sistem bazat pe seccomp, atacatorul poate copia \/bin\/bash \u00een directorul \/var\/snap\/$SNAP\/common \u0219i \u00eei poate seta permisiuni de \u00ab04755\u00bb (suid root). De\u0219i permisiunile au fost modificate \u00een interiorul mediu sandbox, fi\u0219ierul cu permisiuni modificate este accesibil \u0219i \u00een sistemul de baz\u0103, astfel \u00eenc\u00e2t pentru a ob\u021bine acces root complet este suficient s\u0103 se execute \/var\/snap\/\/common\/bash ca utilizator obi\u0219nuit f\u0103r\u0103 privilegii din mediul sistemului standard. <\/p>\n
\u00cen acela\u0219i timp, a fost identificat\u0103 o vulnerabilitate \u00een instrumentele uutils coreutils (Rust Coreutils), un analog al pachetului GNU Coreutils, scris \u00een Rust. Vulnerabilitatea permite unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 drepturi root \u00een sistem. Problema a fost identificat\u0103 \u00een timpul revizuirii modific\u0103rilor \u00een Ubuntu 25.10 \u0219i a fost rezolvat\u0103 pe c\u0103i ocolite \u00eenainte de lansarea Ubuntu 25.10 prin furnizarea \\\/usr\\\/bin\\\/gnurm \u00een loc de uutils rm. \u00cen pachetul uutils, problema a fost remediat\u0103 \u00een versiunea uutils coreutils 0.3.0, f\u0103r\u0103 a men\u021biona \u00een lista de modific\u0103ri rezolvarea vulnerabilit\u0103\u021bii (s-a men\u021bionat c\u0103 \u00een rm, du, chmod \u0219i chgrp a fost implementat\u0103 o metod\u0103 sigur\u0103 de ocolire a c\u0103ilor). <\/p>\n
Problema este cauzat\u0103 de o condi\u021bie de curs\u0103 \u00een utilitarul \u00abrm\u00bb, care permite unui utilizator local s\u0103 \u00eenlocuieasc\u0103 con\u021binutul unui director cu un link simbolic \u00een timpul \u0219tergerii unui fi\u0219ier supus controlului utilizatorului de c\u0103tre procesul \u00abrm\u00bb cu drepturi de root. Printre altele, vulnerabilitatea poate fi exploatat\u0103 prin rularea zilnic\u0103 din cron a scriptului \/etc\/cron.daily\/apport, care este executat cu drepturi de root \u0219i \u0219terge recursiv con\u021binutul directorului \/var\/crash, accesibil pentru scriere tuturor utilizatorilor din sistem. <\/p>\n
Atunci c\u00e2nd \u0219terge directorii recursiv, utilitarul rm verific\u0103 mai \u00eent\u00e2i toate directoarele \u0219i apoi le \u0219terge succesiv \u00een ordine invers\u0103, apel\u00e2nd func\u021bia rmdir(). Dac\u0103 se reu\u0219e\u0219te \u00eenlocuirea directorului p\u0103rinte cu un link simbolic imediat dup\u0103 verificarea acestuia, dar \u00eenainte de a verifica directoarele copil, opera\u021bia va duce la \u0219tergerea directorului la care se refer\u0103 linkul simbolic. Astfel, se poate ob\u021bine nu doar \u0219tergerea oric\u0103rui fi\u0219ier din sistem, ci \u0219i ridicarea privilegiilor prin \u0219tergerea directorului \\\/tmp\\\/snap-private-tmp\\\/$SNAP\\\/tmp\\\/.snap pentru a \u00eenlocui con\u021binutul mediu sandbox al pachetului snap (metoda de ob\u021binere a root-ului este similar\u0103 primei vulnerabilit\u0103\u021bi). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 Ubuntu \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 24.04. \u0412 Ubuntu 16.04-22.04 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u0412 Ubuntu \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165172","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een snapd \u0219i Rust Coreutils, care permit ob\u021binerea privilegiilor root \u00een Ubuntu | ProHoster","description":"Compania Qualys a identificat o vulnerabilitate (CVE-2026-3888) \u00een modul de lucru al combina\u021biei snap-confine \u0219i systemd-tmpfiles \u00een Ubuntu, permi\u021b\u00e2nd unui utilizator f\u0103r\u0103 privilegii s\u0103 ob\u021bin\u0103 acces root la sistem.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 snapd \u0438 Rust \u0421oreutils, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 Ubuntu | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-18T15:12:13+00:00","article:modified_time":"2026-03-18T15:12:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/165172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=165172"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/165172\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=165172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=165172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=165172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"