UNIX hardlink following in Snapd - CVE-2021-44730

Vulnerability identifier: #VU60742

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-44730

CWE-ID: CWE-62

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a hardlink following issue within the the snap-confine binary. A local user can create a hardlink to system binaries and execute them with elevated privileges.

Snapd
snapd (Debian package)
snapd
snap-confine (Ubuntu package)
snapd (Ubuntu package)
Fedora
Ubuntu

Install updates from vendor's website.

Snapd - update to 2.54.3
snapd (Debian package) - addressed in versions 2.37.4-1+deb10u1, 2.49-1+deb11u1
snapd - addressed in versions 2.54.3-1.el7, 2.54.3-1.el8, 2.54.3-1.el9, 2.54.3-1.fc34, 2.54.3-1.fc35
snap-confine (Ubuntu package) - addressed in versions 2.54.3+16.04~esm2, 2.54.3+18.04, 2.54.3+18.04.2ubuntu0.2, 2.54.3+20.04, 2.54.3+20.04.1, 2.54.3+20.04.1ubuntu0.2, 2.54.3+21.10.1, 2.54.3+21.10.1ubuntu0.2
snapd (Ubuntu package) - addressed in versions 2.54.3+16.04~esm2, 2.54.3+18.04, 2.54.3+18.04.2ubuntu0.2, 2.54.3+20.04, 2.54.3+20.04.1, 2.54.3+20.04.1ubuntu0.2, 2.54.3+21.10.1, 2.54.3+21.10.1ubuntu0.2

• https://github.com/snapcore/snapd/releases/tag/2.54.3

• Multiple vulnerabilities in snapd
• Debian update for snapd
• Ubuntu update for snapd
• Ubuntu update for snapd
• Ubuntu update for snapd
• Ubuntu update for snapd
• Fedora 34 update for snapd
• Fedora 35 update for snapd
• Fedora EPEL 7 update for snapd
• Fedora EPEL 8 update for snapd
• Fedora EPEL 9 update for snapd