CVE-2021-4120

Katalog CVE

CVSS 7.8 · High EPSS 0,44%

Kerentanan Improper Input Validation pada canonical snapd, canonical ubuntu linux +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Rincian

Terbit di NVD

17 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://ubuntu.com/security/notices/USN-5292-1 patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/02/18/2 exploit · mailing list · advisory pihak ketiga
• https://bugs.launchpad.net/snapd/+bug/1949368 exploit · issue tracking · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXI...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ7...