NetSight
IP …
high8.2

CVE-2021-4120

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor…

Impact

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Affected products

VendorProductAffected versions
CanonicalSnapd
through 2.54.2
CanonicalUbuntu Linux
Versions 18.04, 20.04, 21.10
FedoraprojectFedora
Versions 34, 35

Weakness classification

CWE-20

References