Race Condition Vulnerability in Snap-Confine Affecting Ubuntu
CVE-2022-3328

7HIGH

Key Information:

Vendor

Canonical Ltd.

Status
Snapd
Vendor
CVE Published:
8 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-3328?

A race condition exists in the snap-confine functionality, particularly within the must_mkdir_and_open_with_perms() method. This vulnerability can lead to insecure file operations that compromise system integrity, allowing possible unauthorized access to sensitive files or the execution of arbitrary code. Users running affected versions of Ubuntu are advised to apply the necessary updates to mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

snapd Linux 0 < 2.61.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-3328
Created by Mr-xn

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3328
issue-tracking
https://ubuntu.com/security/notices/USN-5753-1
third-party-advisory

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

Credit

Qualys
JSON
.