PT-2021-19420 · Canonical+3 · Snapd+4

James Troup + 1 · Published 2021-01-13 · Updated 2022-04-26 · CVE-2021-3155

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions snapd versions 2.54.2 and earlier

Description The issue allows a local attacker to read private information due to the creation of ~/snap directories in user home directories without specifying owner-only permissions.

Recommendations For snapd versions 2.54.2 and earlier, update to version 2.54.3+18.04, 2.54.3+20.04, or 2.54.3+21.10.1 to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2022-1345

ALT-PU-2022-1765

CVE-2021-3155

USN-5292-1

USN-5292-2

USN-5292-3

USN-5292-4

Affected Products

Alt Linux

Debian

Linuxmint

Ubuntu

Snapd

References · 25

• https://github.com/snapcore/snapd/commit/6bcaeeccd16ed8298a301dd92f6907f88c24cc85 · Patch
• https://github.com/snapcore/snapd/commit/7d2a966620002149891446a53cf114804808dcca · Patch
• https://osv.dev/vulnerability/USN-5292-4 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3155 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5292-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3155 · Security Note
• https://ubuntu.com/security/CVE-2021-4120 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5292-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3155 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5292-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5292-3 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5292-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44730 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5292-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44731 · Vendor Advisory