[USN-5292-2] snapd vulnerabilities

[Emilia Torino]

==========================================================================
Ubuntu Security Notice USN-5292-2
February 18, 2022

snapd vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in snapd.

Software Description:
- snapd: Daemon and tooling that enable snap packages

Details:

USN-5292-1 fixed vulnerabilities in snapd. This update provides the
corresponding update for the riscv64 architecture.

Original advisory details:

  James Troup discovered that snap did not properly manage the
  permissions for the snap directories. A local attacker could possibly
  use this issue to expose sensitive information. (CVE-2021-3155)

  Ian Johnson discovered that snapd did not properly validate content
  interfaces and layout paths. A local attacker could possibly use this
  issue to inject arbitrary AppArmor policy rules, resulting in a bypass
  of intended access restrictions. (CVE-2021-4120)

  The Qualys Research Team discovered that snapd did not properly
  validate the location of the snap-confine binary. A local attacker
  could possibly use this issue to execute other arbitrary binaries and
  escalate privileges. (CVE-2021-44730)

  The Qualys Research Team discovered that a race condition existed in
  the snapd snap-confine binary when preparing a private mount namespace
  for a snap. A local attacker could possibly use this issue to escalate
  privileges and execute arbitrary code. (CVE-2021-44731)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
   snap-confine                    2.54.3+20.04.1
   snapd                           2.54.3+20.04.1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-5292-2
   https://ubuntu.com/security/notices/USN-5292-1
   CVE-2021-3155, CVE-2021-4120, CVE-2021-44730, CVE-2021-44731

Package Information:
   https://launchpad.net/ubuntu/+source/snapd/2.54.3+20.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20220217/688d6f3d/attachment-0001.sig>