This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-44730 →

DEBIAN-CVE-2021-44730

snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to c...

Original description

The description as published by the source.

snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap-confine to execute other arbitrary binaries and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 snapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-1"}]}]

Debian:13 snapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-1"}]}]

Debian:14 snapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-1"}]}]

References

advisory security-tracker.debian.org