Source: snapd Version: 2.76-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for snapd. CVE-2026-15226[0]: | A sandbox confinement bypass vulnerability exists in Canonical snapd | within its internal execution environment compiler (snap-confine). | The default seccomp security templates generated by the engine to | restrict system calls do not filter or reject process operations | capable of creating or manipulating file execution flags with set- | user-ID attributes. Consequently, an application running within a | strictly confined snap environment can successfully compile or drop | binaries and apply setuid properties to them. If a compromised or | malicious process inside the snap sandbox executes these generated | setuid binaries, it can potentially circumvent architectural | sandboxing assumptions, drop intended restriction policies, or | execute privileged actions inside the container namespace that | should otherwise be strictly blocked. The vulnerability has been | resolved by hardening the seccomp template engine to block the | execution and creation of setuid executables by sandboxed snap | processes. CVE-2024-5300[1]: | An access control bypass and information disclosure vulnerability | exists in the base AppArmor security profile configuration of | Canonical snapd. The abstraction rules located in | /etc/apparmor.d/abstractions/nss-systemd (inherited via ) | inadvertently permit strictly confined snap applications, which lack | the privileged account-control interface, to interact directly with | the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX | domain sockets under /run/systemd/userdb/. On systems where the | systemd-userdbd service is installed and operational, the service | fails to distinguish between an unconfined root user on the host | system and a restricted root user running within a snap | application's sandbox (such as a daemon or configuration hook). | Because systemd-userdbd returns "complete" user records—including | sensitive hashed user passwords from /etc/shadow—when queried by a | process running as root, a compromised or malicious strictly | confined snap executing code as root can successfully query the | Varlink interface to retrieve all system password hashes, bypassing | intended snap sandbox restrictions. This issue is mitigated by the | fact that systemd-userdbd is not installed by default on standard | Ubuntu deployments. CVE-2026-8933[2]: | A local privilege escalation vulnerability exists in snap-confine, a | set-capabilities core component used internally by Canonical snapd | to construct the secure execution environment for snap applications. | This vulnerability uniquely affects versions of snap-confine | configured with set-capabilities (rather than standard set-uid-root | installations). Due to a flaw in how privilege boundaries or | security sandboxes are initialized when the binary runs under | limited ambient capabilities, a local, unprivileged attacker can | exploit this behavior to bypass intended restrictions and execute | arbitrary code. Successful exploitation allows the local user to | elevate their privileges to full root authority. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-15226 https://www.cve.org/CVERecord?id=CVE-2026-15226 [1] https://security-tracker.debian.org/tracker/CVE-2024-5300 https://www.cve.org/CVERecord?id=CVE-2024-5300 [2] https://security-tracker.debian.org/tracker/CVE-2026-8933 https://www.cve.org/CVERecord?id=CVE-2026-8933 Regards, Salvatore
