snapd could be made to escalate privileges and run programs as administrator

Vulnerability

A race condition exists in the snap-confine binary (version 2.54.2) when preparing a private mount namespace for a snap. Specifically, during the execution of setup_private_mount(), an attacker can exploit a time-of-check-time-of-use (TOCTOU) flaw to bind-mount their own contents inside the snap's private mount namespace. This affects snapd versions prior to 2.54.3 on Ubuntu 18.04, 20.04, and 21.10 [3][4].

Exploitation

A local attacker with the ability to create a bind mount during the race window can cause snap-confine to execute arbitrary code. The attacker must be able to trigger the race condition by manipulating the filesystem while snap-confine is setting up the mount namespace. No special privileges beyond local access are required [4].

Impact

Successful exploitation allows the attacker to execute arbitrary code as root, resulting in full privilege escalation and compromise of the system. The attacker gains complete control over the affected host [3][4].

Mitigation

The vulnerability is fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04, and 2.54.3+21.10.1. Users should update snapd to the latest version via their package manager. No workaround is available [4].