Hi everyone,

Qualys discovered another Local Privilege Escalation (LPE) in snapd 
snap-confine,
via Capabilities misconfiguration. Qualys will send an email on top of this one
with their report, but in the meantime, for this vulnerability we assigned
CVE-2026-8933, with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 7.8 HIGH

The upstream version of snapd containing the fix will be 2.76.1.

Also in this version we are fixing/disclosing other two vulnerabilities
- CVE-2024-5300
  AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps
  Unauthorized Access to Hashed Passwords via systemd-userdbd
  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N 5.6 MEDIUM
  Credits: James Henstridge

- CVE-2026-15226
  snapd snap-confine Sandbox Confinement Bypass via Omission of setuid
  Restriction in Seccomp Templates
  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N 8.4 HIGH
  Credits: Zygmunt Krynicki

In Ubuntu those fixes will land in:

Xenial (16.04): snapd - 2.61.4ubuntu0.16.04.1+esm4
Bionic (18.04): snapd - 2.61.4ubuntu0.18.04.1+esm4
Focal (20.04): snapd - 2.67.1+20.04ubuntu1~esm3
Jammy (22.04): snapd - 2.76+ubuntu22.04.1
Noble (24.04): snapd - 2.76+ubuntu24.04.1
Resolute (26.04): snapd - 2.76+ubuntu26.04.3

And we will soon be publishing an advisory:
https://ubuntu.com/security/notices/USN-8579-1

We want to thanks again Qualys, Zygmunt and James for their work and patience!

Thanks,
Eduardo

Attachment: signature.asc
Description: PGP signature

Reply via email to