VDB
CVE-2021-4120
CVE-2021-4120
PUBLISHED
CVSS 8.199999809265137 HIGH
snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
EPSS 0.44% · 36.6th percentile
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS Score
0.44%
36.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | snapd | * |
| fedoraproject | fedora | 35, 34 |
| canonical | ubuntu_linux | 20.04, 18.04, 21.10 |
| canonical | snapd | 0 |
Timeline
- Feb 17, 2022 CVE Published
- Feb 18, 2022 EPSS Score
- Apr 11, 2022 EPSS Score
- Jun 3, 2022 EPSS Score
- Jul 26, 2022 EPSS Score
- Sep 16, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Dec 30, 2022 EPSS Score
- Feb 20, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 13, 2023 EPSS Score
- Jun 4, 2023 EPSS Score
References
- https://ubuntu.com/security/notices/USN-5292-1 url
- https://bugs.launchpad.net/snapd/+bug/1949368 url
- [oss-security] 20220218 CVE-2021-4120: Insufficient validation of snap content interface and layout paths mailing-list
- FEDORA-2022-82bea71e5a vendor-advisory
- FEDORA-2022-5df8b52ba4 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-4120 advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7 url