CVE-2021-4120

snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths

State: Published
Severity: 8.2 High
Published: Feb 17, 2022
Updated: Aug 3, 2024
Reserved: Dec 14, 2021

Description

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	canonical

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
snapdCanonical Ltd.	2.54.2 and earlierAffected

References

https://ubuntu.com/security/notices/USN-5292-1
https://bugs.launchpad.net/snapd/+bug/1949368
[oss-security] 20220218 CVE-2021-4120: Insufficient validation of snap content interface and layout pathsmailing-list
FEDORA-2022-82bea71e5avendor-advisory
FEDORA-2022-5df8b52ba4vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.