Vulnerability · Published Feb 17, 2022 · Assigned by canonical
CVE-2021-3155snapd created ~/snap with too-wide permissions
Low 3.8
In plain English
A low-severity incorrect default permissions in snapd from Canonical Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | snapd | 2.54-1 | DEBIAN-CVE-2021-3155 |
| Debian:13 | snapd | 2.54-1 | DEBIAN-CVE-2021-3155 |
| Debian:14 | snapd | 2.54-1 | DEBIAN-CVE-2021-3155 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical Ltd. | snapd | unspecified – through 2.54.2 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N