CVE-2021-44731 | Vulnetix

CVE-2021-44731 PUBLISHED CVSS 7.800000190734863 HIGH

A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

EPSS 0.94% · 58.2th percentile

Risk Scores

CVSS 3.1

7.800000190734863

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score

0.94%

58.2th percentile

Affected Products

Vendor	Product	Versions
fedoraproject	fedora	35, 34
canonical	snapd	0
canonical	ubuntu_linux	20.04, 21.10, 18.04
debian	debian_linux	11.0, 10.0
Canonical Ltd.	snapd	*

Timeline

Feb 17, 2022 CVE Published
Feb 18, 2022 EPSS Score
Feb 20, 2022 EPSS Score
Jun 3, 2022 EPSS Score
Jul 26, 2022 EPSS Score
Nov 8, 2022 EPSS Score
Dec 10, 2022 PoC Published
Dec 30, 2022 EPSS Score
Feb 20, 2023 EPSS Score
Apr 14, 2023 EPSS Score
Jun 5, 2023 EPSS Score
Sep 18, 2023 EPSS Score

References

Open in Interactive Console →