CVE-2021-4120 snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths

2022-02-1722:15:21

CWE-20

canonical

www.cve.org

cve-2021-4120

snapd

access restrictions

snap content interfaces

layout paths

validation

apparmor

confinement

snapd 2.54.2

snapd 2.54.3+18.04

snapd 2.54.3+20.04

snapd 2.54.3+21.10.1

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

34.4%

JSON

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

CNA Affected

[
  {
    "product": "snapd",
    "vendor": "Canonical Ltd.",
    "versions": [
      {
        "lessThanOrEqual": "2.54.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]