USN-8102-2

USN-8102-1 fixed a vulnerability in snapd. The update caused a regresision for Ubuntu 24.04 LTS while installing the package. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Qualys discovered that snapd incorrectly handled certain operations in the snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation.

References

Affected packages

Ubuntu:24.04:LTS / snapd

Package

Name: snapd
Purl: pkg:deb/ubuntu/snapd@2.73+ubuntu24.04.2?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.73+ubuntu24.04.2

Affected versions

2.*

2.60.4+23.10

2.61.3+24.04

2.62+24.04build1

2.63+24.04

2.63+24.04ubuntu0.1

2.63.1+24.04

2.65.3+24.04

2.66.1+24.04

2.67.1+24.04

2.68.5+ubuntu24.04.1

2.71+ubuntu24.04

2.72+ubuntu24.04

2.73+ubuntu24.04

2.73+ubuntu24.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "golang-github-snapcore-snapd-dev",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "golang-github-ubuntu-core-snappy-dev",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "snap-confine",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "snapd",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "snapd-xdg-open",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "ubuntu-core-launcher",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "ubuntu-core-snapd-units",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "ubuntu-snappy",
            "binary_version": "2.73+ubuntu24.04.2"
        },
        {
            "binary_name": "ubuntu-snappy-cli",
            "binary_version": "2.73+ubuntu24.04.2"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-3888",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "high"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8102-2.json"