Kompania Qualys identifikoi nj\u00eb ndjeshm\u00ebri (CVE-2026-3888) n\u00eb funksionimin e lidhjes snap-confine dhe systemd-tmpfiles n\u00eb Ubuntu, e cila lejon nj\u00eb p\u00ebrdorues pa privilegje t\u00eb fitoj\u00eb qasje root n\u00eb sistem. Problemi shfaqet n\u00eb Ubuntu n\u00eb konfigurimin e paracaktuar q\u00eb nga l\u00ebshimi 24.04. N\u00eb Ubuntu 16.04-22.04, ndjeshm\u00ebria mund t\u00eb shfryt\u00ebzohet n\u00eb konfigurime t\u00eb paspecifikuara q\u00eb imitojn\u00eb sjelljen e versioneve m\u00eb t\u00eb reja t\u00eb distribucionit. N\u00eb Ubuntu, nj\u00eb korrigjim \u00ebsht\u00eb n\u00eb dispozicion n\u00eb p\u00ebrdit\u00ebsimin e djesh\u00ebm t\u00eb paket\u00ebs snapd. N\u00eb snapd, problemi \u00ebsht\u00eb zgjidhur n\u00eb p\u00ebrdit\u00ebsimin 2.75. <\/p>\n
Ndjeshm\u00ebria ndodh p\u00ebr shkak t\u00eb nd\u00ebrveprimit t\u00eb gabuar t\u00eb mjeteve snap-confine dhe systemd-tmpfiles, t\u00eb cilat ekzekutohen me privilegje t\u00eb rritura. Mjeti snap-confine formon nj\u00eb ambient sandbox p\u00ebr ekzekutimin e aplikacionit snap, nd\u00ebrsa systemd-tmpfiles kryen pastrimin automatik t\u00eb skedar\u00ebve dhe direktoreve t\u00eb p\u00ebrkohshme. Nga ana e paracaktuar, mjeti systemd-tmpfiles \u00ebsht\u00eb i konfiguruar p\u00ebr t\u00eb fshir\u00eb t\u00eb gjith\u00eb skedar\u00ebt dhe direktoret e vjetra n\u00eb \/tmp, \u00e7ka mund t\u00eb p\u00ebrdoret nga nj\u00eb sulmues p\u00ebr t\u00eb nd\u00ebrruar direktoren \/tmp\/.snap n\u00eb momentin pas fshirjes nga mjeti systemd-tmpfiles, por para rinisjes nga ekipi snap-confine. <\/p>\n
Sulmi p\u00ebrfshin pritjen e nisjes s\u00eb procesit t\u00eb pastrimit t\u00eb skedar\u00ebve t\u00eb p\u00ebrkohsh\u00ebm, z\u00ebvend\u00ebsimin e direktoriumit \/tmp\/.snap pas fshirjes s\u00eb tij dhe vendosjen e nj\u00eb kopjeje t\u00eb modifikuar t\u00eb bibliotekave n\u00eb \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange. Sulmuesi mund t\u00eb ket\u00eb nevoj\u00eb p\u00ebr disa dit\u00eb p\u00ebr t\u00eb pritur nisjen e systemd-tmpfiles, pasi n\u00eb Ubuntu 24.04 procesi i pastrimit niset \u00e7do 10 dit\u00eb, dhe n\u00eb versione m\u00eb t\u00eb reja \u2014 \u00e7do 30 dit\u00eb. Pas z\u00ebvend\u00ebsimit t\u00eb direktoriumit, sulmuesi arrin t\u00eb inicializoj\u00eb nj\u00eb mjedis t\u00eb ri sandbox duke p\u00ebrdorur snap-confine. <\/p>\n
Gjat\u00eb formimit t\u00eb ambalazhit t\u00eb mjedisit sandbox n\u00eb direktorine e p\u00ebrkohshme \/tmp\/.snap, sulmuesi pret momentin e duhur dhe riem\u00ebron \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange n\u00eb \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu, duke nd\u00ebrruar k\u00ebshtu bibliotekat dhe duke siguruar montimin e tyre bind me privilegje root. K\u00ebshtu, sulmuesi fiton kontroll mbi bibliotekat e ndara dhe mbi ngarkuesin ld.so, q\u00eb ekzekutohen n\u00eb ambientin sandbox t\u00eb snap, dhe mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kod t\u00eb rast\u00ebsish\u00ebm me privilegje root p\u00ebrmes nisjes s\u00eb \u00e7do programi suid, ku p\u00ebrdoret lidhja dinamike. <\/p>\n
Dhe me qasje root n\u00eb mjedisin sandbox, i izoluar p\u00ebrmes AppArmor dhe filtrit t\u00eb thirrjeve sistemike t\u00eb bazuar n\u00eb seccomp, sulmuesi mund t\u00eb kopjoj\u00eb \/bin\/bash n\u00eb direktoriumin \/var\/snap\/$SNAP\/common\/ dhe t'i jap\u00eb atij t\u00eb drejtat \u201c04755\u201d (suid root). Megjith\u00ebse t\u00eb drejtat jan\u00eb modifikuar brenda mjedisit sandbox, skedari me t\u00eb drejtat e modifikuara \u00ebsht\u00eb gjithashtu i aksesuesh\u00ebm n\u00eb sistemin kryesor, prandaj p\u00ebr t\u00eb fituar qasje t\u00eb plot\u00eb root, mjafton t\u00eb ekzekutohet \/var\/snap\/\/common\/bash si nj\u00eb p\u00ebrdorues i zakonsh\u00ebm pa privilegje nga mjedisi standard i sistemit. <\/p>\n
P\u00ebrve\u00e7 k\u00ebsaj, u identifikua nj\u00eb ndjeshm\u00ebri n\u00eb mjetin uutils coreutils (Rust Coreutils), nj\u00eb ekuivalent i paket\u00ebs GNU Coreutils, i shkruar n\u00eb gjuh\u00ebn Rust. Ndjeshm\u00ebria lejon nj\u00eb p\u00ebrdorues pa privilegje t\u00eb fitoj\u00eb privilegje root n\u00eb sistem. Problemi u identifikua gjat\u00eb rishikimit t\u00eb ndryshimeve n\u00eb Ubuntu 25.10 dhe u zgjidh n\u00eb m\u00ebnyr\u00eb t\u00eb p\u00ebrkohshme p\u00ebrpara l\u00ebshimit t\u00eb Ubuntu 25.10 p\u00ebrmes ofrimit t\u00eb \/usr\/bin\/gnurm n\u00eb vend t\u00eb uutils rm. N\u00eb paket\u00ebn uutils problemi u zgjidh n\u00eb l\u00ebshimin uutils coreutils 0.3.0, pa sh\u00ebnim n\u00eb list\u00ebn e ndryshimeve p\u00ebr zgjidhjen e ndjeshm\u00ebris\u00eb (u tha se n\u00eb rm, du, chmod dhe chgrp \u00ebsht\u00eb realizuar nj\u00eb metod\u00eb e sigurt p\u00ebr evitimin e rrug\u00ebve). <\/p>\n
Problemi shkaktohet nga nj\u00eb gjendje garancie n\u00eb utilitarin \u201crm\u201d, q\u00eb i lejon p\u00ebrdoruesit lokal t\u00eb z\u00ebvend\u00ebsoj\u00eb p\u00ebrmbajtjen e direktoriumit me nj\u00eb lidhje simbolike gjat\u00eb eliminimit t\u00eb nj\u00eb skedari t\u00eb kontrolluar nga p\u00ebrdoruesi nga procesi \u201crm\u201d me t\u00eb drejta root. Nd\u00ebr t\u00eb tjera, kjo vulnerabilitet mund t\u00eb shfryt\u00ebzohet kur ekzekutohet \u00e7do dit\u00eb nga skripti cron n\u00eb \/etc\/cron.daily\/apport, i cili ekzekutohet me t\u00eb drejta root dhe fshin me rekurzion p\u00ebrmbajtjen e direktoriumit \/var\/crash, e cila \u00ebsht\u00eb e shkruashme p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit n\u00eb sistem. <\/p>\n
Gjat\u00eb fshirjes rekursive t\u00eb direktor\u00ebve, mjeti rm fillimisht kontrollon t\u00eb gjitha direktor\u00ebt dhe pastaj i fshin ato nj\u00eb nga nj\u00eb n\u00eb rendin e duhur, duke thirrur funksionin rmdir(). N\u00ebse arrihet t\u00eb nd\u00ebrron direktoren prind n\u00eb nj\u00eb lidhje simbolike menj\u00ebher\u00eb pas kontrollit t\u00eb k\u00ebsaj direktore, por para kontrollit t\u00eb direktor\u00ebve t\u00eb f\u00ebmij\u00ebve brenda saj, operacioni do t\u00eb \u00e7oj\u00eb n\u00eb fshirjen e direktor\u00ebs q\u00eb shikohet nga lidhja simbolike. K\u00ebshtu, mund t\u00eb arrij\u00eb jo vet\u00ebm t\u00eb fshij\u00eb \u00e7do skedar n\u00eb sistem, por gjithashtu t\u00eb rris\u00eb privilegjet p\u00ebrmes fshirjes s\u00eb direktor\u00ebs \/tmp\/snap-private-tmp\/$SNAP\/tmp\/.snap p\u00ebr t\u00eb nd\u00ebrruar p\u00ebrmbajtjen e ambientit sandbox t\u00eb paket\u00ebs snap (metoda p\u00ebr t\u00eb fituar root \u00ebsht\u00eb e ngjashme me ndjeshm\u00ebrin\u00eb e par\u00eb). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 Ubuntu \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 24.04. \u0412 Ubuntu 16.04-22.04 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u0412 Ubuntu \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165172","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitete n\u00eb snapd dhe Rust Coreutils, q\u00eb lejojn\u00eb marrjen e privilegjeve root n\u00eb Ubuntu | ProHoster","description":"Kompania Qualys zbuloi nj\u00eb vulnerabilitet (CVE-2026-3888) n\u00eb organizimin e pun\u00ebs s\u00eb lidhjes snap-confine dhe systemd-tmpfiles n\u00eb Ubuntu, q\u00eb lejon nj\u00eb p\u00ebrdorues t\u00eb pa privilegjuar t\u00eb marr\u00eb qasje root n\u00eb sistem. Problemi shfaqet n\u00eb Ubuntu n\u00eb konfigurimin e paracaktuar q\u00eb nga l\u00ebshimi 24.04. N\u00eb Ubuntu 16.04-22.04, vulnerabiliteti mund t\u00eb shfryt\u00ebzohet n\u00eb konfigurime jo standarde q\u00eb imitojn\u00eb sjelljen e versioneve m\u00eb t\u00eb reja t\u00eb distribucionit. N\u00eb Ubuntu, rregullimi \u00ebsht\u00eb n\u00eb dispozicion nga dje.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 snapd \u0438 Rust \u0421oreutils, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 Ubuntu | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 Ubuntu \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 24.04. \u0412 Ubuntu 16.04-22.04 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u0412 Ubuntu \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-18T15:12:13+00:00","article:modified_time":"2026-03-18T15:12:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/165172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=165172"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/165172\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=165172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=165172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=165172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"