In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Link | Tags |
---|---|
https://github.com/snapcore/snapcraft/pull/3345 | third party advisory |
https://usn.ubuntu.com/usn/usn-4661-1 | third party advisory patch |
https://bugs.launchpad.net/bugs/1901572 | issue tracking exploit third party advisory |