CVE-2021-3155

NameCVE-2021-3155
Descriptionsnapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
snapd (PTS)stretch2.21-2vulnerable
stretch (security)2.21-2+deb9u1vulnerable
buster2.37.4-1vulnerable
buster (security)2.37.4-1+deb10u1vulnerable
bullseye, bullseye (security)2.49-1+deb11u1vulnerable
bookworm, sid2.54.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
snapdsource(unstable)2.54-1

Notes

[bullseye] - snapd <no-dsa> (Minor issue)
[buster] - snapd <no-dsa> (Minor issue)
https://github.com/snapcore/snapd/pull/9841
https://github.com/snapcore/snapd/commit/6bcaeeccd16ed8298a301dd92f6907f88c24cc85 (2.52)
https://github.com/snapcore/snapd/commit/7d2a966620002149891446a53cf114804808dcca (2.54)

Search for package or bug name: Reporting problems