F\u00f6retaget Qualys har uppt\u00e4ckt en s\u00e5rbarhet (CVE-2026-3888) i hur snap-confine och systemd-tmpfiles arbetar tillsammans i Ubuntu, vilket g\u00f6r det m\u00f6jligt f\u00f6r en icke-privilegierad anv\u00e4ndare att f\u00e5 root-\u00e5tkomst till systemet. Problemet uppst\u00e5r i Ubuntu i standardkonfigurationen fr\u00e5n och med version 24.04. I Ubuntu 16.04-22.04 kan s\u00e5rbarheten utnyttjas i icke-standardkonfigurationer som efterliknar beteendet hos nyare versioner av distributionen. En l\u00f6sning f\u00f6r Ubuntu blev tillg\u00e4nglig i g\u00e5rdagens uppdatering av snapd. Problemet med snapd har \u00e5tg\u00e4rdats i uppdatering 2.75. <\/p>\n
S\u00e5rbarheten uppst\u00e5r p\u00e5 grund av felaktig interaktion mellan verktygen snap-confine och systemd-tmpfiles, som k\u00f6rs med f\u00f6rh\u00f6jda privilegier. Verktyget snap-confine skapar en sandbox-milj\u00f6 f\u00f6r att k\u00f6ra snap-applikationer, medan systemd-tmpfiles hanterar automatisk rensning av tempor\u00e4ra filer och kataloger. Som standard \u00e4r systemd-tmpfiles konfigurerad att ta bort alla gamla filer och kataloger i \/tmp, vilket kan utnyttjas av en angripare f\u00f6r att manipulera katalogen \/tmp\/.snap just efter dess borttagning av systemd-tmpfiles, men innan den \u00e5terskapas av snap-confine. <\/p>\n
Attack involves waiting for the process of cleaning temporary files to start, replacing the directory \/tmp\/.snap after its deletion, and placing a modified copy of the libraries \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange. The attacker may need to wait several days for systemd-tmpfiles to start, as in Ubuntu 24.04 the cleaning process runs every 10 days, and in newer versions \u2014 every 30 days. After the directory replacement, the attacker achieves initialization of a new sandbox environment using snap-confine. <\/p>\n
Under skapandet av sandbox-milj\u00f6n i den tempor\u00e4ra katalogen \/tmp\/.snap v\u00e4ntar angriparen p\u00e5 r\u00e4tt \u00f6gonblick och d\u00f6per om \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu.exchange till \/tmp\/.snap\/usr\/lib\/x86_64-linux-gnu, vilket p\u00e5 s\u00e5 vis manipulerar biblioteken och s\u00e4kerst\u00e4ller bindmontering med root-r\u00e4ttigheter. P\u00e5 s\u00e5 s\u00e4tt f\u00e5r angriparen kontroll \u00f6ver de delade biblioteken och laddaren ld.so, som k\u00f6rs i snap-sandbox-milj\u00f6n, och kan f\u00e5 exekvering av godtycklig kod med root-r\u00e4ttigheter genom att starta vilket som helst suid-program d\u00e4r dynamisk l\u00e4nkning anv\u00e4nds. <\/p>\n
Having root access in a sandbox environment isolated through AppArmor and a syscall filtering based on seccomp, the attacker can copy \/bin\/bash to the directory \/var\/snap\/$SNAP\/common\/ and set its permissions to '04755' (suid root). Although the permissions are changed within the sandbox environment, the file with modified permissions is also accessible in the main system, so to gain full root access, it is enough to execute \/var\/snap\/\/common\/bash as a regular unprivileged user from the default system environment. <\/p>\n
Samtidigt uppt\u00e4cktes en s\u00e5rbarhet i verktyget uutils coreutils (Rust Coreutils), en motsvarighet till GNU Coreutils-paketet, skrivet i Rust. S\u00e5rbarheten m\u00f6jligg\u00f6r f\u00f6r en icke-privilegierad anv\u00e4ndare att f\u00e5 root-r\u00e4ttigheter i systemet. Problemet uppt\u00e4cktes under granskningen av \u00e4ndringar i Ubuntu 25.10 och l\u00f6stes som en tillf\u00e4llig l\u00f6sning f\u00f6re lanseringen av Ubuntu 25.10 genom att leverera \/usr\/bin\/gnurm ist\u00e4llet f\u00f6r uutils rm. I paketet uutils \u00e5tg\u00e4rdades problemet i versionen uutils coreutils 0.3.0, utan att det angavs i \u00e4ndringsloggen att s\u00e5rbarheten \u00e5tg\u00e4rdades (det angavs att ett s\u00e4kert s\u00e4tt att kringg\u00e5 s\u00f6kv\u00e4gar hade implementerats i rm, du, chmod och chgrp). <\/p>\n
The issue is caused by a race condition in the 'rm' utility, allowing a local user to replace the contents of a directory with a symbolic link during the deletion of a user-controlled file by the 'rm' process with root privileges. Among other things, this vulnerability can be exploited when the script \/etc\/cron.daily\/apport is run daily, which runs with root privileges and recursively deletes the contents of the \/var\/crash directory, writable by all users in the system. <\/p>\n
Vid rekursiv borttagning av kataloger kontrollerar verktyget rm f\u00f6rst alla kataloger, och tar sedan bort dem i omv\u00e4nd ordning genom att anropa funktionen rmdir(). Om man lyckas byta ut den \u00f6verordnade katalogen mot en symbolisk l\u00e4nk direkt efter att denna katalog har kontrollerats, men innan de underordnade katalogerna kontrolleras, kommer operationen att leda till att katalogen som den symboliska l\u00e4nken pekar p\u00e5 tas bort. P\u00e5 s\u00e5 s\u00e4tt kan man inte bara f\u00e5 bort vilket fil som helst i systemet, utan ocks\u00e5 h\u00f6ja privilegierna genom att ta bort katalogen \/tmp\/snap-private-tmp\/$SNAP\/tmp\/.snap f\u00f6r att byta ut inneh\u00e5llet i sandbox-milj\u00f6n f\u00f6r snap-paketet (metoden f\u00f6r att f\u00e5 root \u00e4r likadan som den f\u00f6rsta s\u00e5rbarheten). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 Ubuntu \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 24.04. \u0412 Ubuntu 16.04-22.04 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u0412 Ubuntu \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432\u043e \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-165172","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheter i snapd och Rust Coreutils, som m\u00f6jligg\u00f6r rootbeh\u00f6righeter i Ubuntu | ProHoster","description":"F\u00f6retaget Qualys har identifierat en s\u00e5rbarhet (CVE-2026-3888) i samarbetet mellan snap-confine och systemd-tmpfiles i Ubuntu, vilket g\u00f6r att en icke-privilegerad anv\u00e4ndare kan f\u00e5 rootbeh\u00f6righet till systemet.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 snapd \u0438 Rust \u0421oreutils, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 Ubuntu | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3888) \u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0432\u044f\u0437\u043a\u0438 snap-confine \u0438 systemd-tmpfiles \u0432 Ubuntu, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimosti-v-snapd-i-rust-soreutils-pozvolyayushhie-poluchit-root-privilegii-v-ubuntu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-18T15:12:13+00:00","article:modified_time":"2026-03-18T15:12:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/165172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=165172"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/165172\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=165172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=165172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=165172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"