PT-2022-5709 · Canonical+3 · Snap-Confine+5

Qualys · Published 2022-11-30 · Updated 2024-06-14 · CVE-2022-3328

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions snapd versions prior to 2.57.6 snap-confine versions prior to 2.57.6

Description The issue is related to a race condition in the must mkdir and open with perms() function of the snap-confine utility. This vulnerability can be exploited to elevate privileges or execute arbitrary code. The problem is associated with synchronization errors when using a shared resource, also known as a "race condition".

Recommendations For versions prior to 2.57.6, update to version 2.57.6 or later to resolve the issue. As a temporary workaround, consider disabling the must mkdir and open with perms() function until a patch is available.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2024-6157

ALT-PU-2024-8892

BDU:2022-07107

CVE-2022-3328

DLA-3215-1

DSA-5292-1

GHSA-CJQF-877P-7M3F

GO-2024-2468

USN-5753-1

Affected Products

Alt Linux

Linuxmint

Red Os

Ubuntu

Snap-Confine

Snapd

References · 29

• 🔥 https://github.com/Mr-xn/CVE-2022-3328 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3328 · Security Note
• https://osv.dev/vulnerability/DSA-5292-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3215-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjqf-877p-7m3f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3328 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-3328 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3328 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3328 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5753-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5753-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3328 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07107 · Security Note