CVE-2021-4120

EUVD-2021-33996
snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
canonicalCNA
8.2 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 25%
Affected Products (NVD)
VendorProductVersion
canonicalsnapd
𝑥
≤ 2.54.2
canonicalubuntu_linux
18.04
canonicalubuntu_linux
20.04
canonicalubuntu_linux
21.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
snapd
bookworm
2.57.6-1
fixed
bullseye
2.49-1+deb11u2
fixed
bullseye (security)
2.49-1+deb11u2
fixed
buster
ignored
sid
2.65.3-1
fixed
trixie
2.65.3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
snapd
bionic
Fixed 2.54.3+18.04
released
focal
Fixed 2.54.3+20.04
released
hirsute
ignored
impish
Fixed 2.54.3+21.10.1
released
trusty
Fixed 2.54.3+14.04~esm1
released
xenial
Fixed 2.54.3+16.04~esm2
released
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2022/02/18/2
https://bugs.launchpad.net/snapd/+bug/1949368
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/
https://ubuntu.com/security/notices/USN-5292-1
http://www.openwall.com/lists/oss-security/2022/02/18/2
https://bugs.launchpad.net/snapd/+bug/1949368
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/
https://ubuntu.com/security/notices/USN-5292-1