CVE-2021-4120 snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths

What is CVE-2021-4120?

CVE-2021-4120 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 17 Feb 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Weakness: CWE-20

Which versions are affected by CVE-2021-4120?

It affects 3 products.

Products include Canonical Snapd, Canonical Ubuntu Linux, Fedoraproject Fedora.

How do I fix CVE-2021-4120?

Upgrade to a fixed version.

Is CVE-2021-4120 being exploited?

There is no known exploitation of CVE-2021-4120 in the wild and no public exploit code.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2023-1523 Command injection in snapd Critical 10.0
• CVE-2020-27352 Privilege escalation in snapd Critical 9.3
• CVE-2019-7304 Local privilege escalation via snapd socket High 8.8
• CVE-2024-5138 CVE-2024-5138: snapd snapctl auth bypass High 8.1
• CVE-2022-3328 snapd Race Condition vulnerability High 7.8

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-4120, GHSA-hfvx-54vj-h9wq, UBUNTU-CVE-2021-4120.