Back Linuxsecurity Ubuntu 24.04 LTS snapd Important Privilege Escalation Fix USN-8102
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: USN-8102-1 introduced a regression in snapd Software Description: - snapd: Daemon and tooling that enable snap packages Details: USN-8102-1 fixed a vulnerability in snapd. The update caused a regresision for Ubuntu 24.04 LTS while installing the package. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Qualys discovered that snapd incorrectly handled certain operations in the snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation.
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: USN-8102-1 introduced a regression in snapd Software Description: - snapd: Daemon and tooling that enable snap packages Details: USN-8102-1 fixed a vulnerability in snapd. The update caused a regresision for Ubuntu 24.04 LTS while installing the package. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Qualys discovered that snapd incorrectly handled certain operations in the snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation.
The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS snapd 2.73+ubuntu24.04.2 After a standard system update you need to reboot your computer to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS snapd 2.73+ubuntu24.04.2 After a standard system update you need to reboot your computer to make all the necessary changes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
