USN-5292-4
snapd regression
USN-5292-1 fixed a vulnerability in snapd. Unfortunately that update introduced a regression that could break the fish shell. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information. (CVE-2021-3155)
Ian Johnson discovered that snapd did not properly validate content interfaces and layout paths. A local attacker could possibly use this issue to inject arbitrary AppArmor policy rules, resulting in a bypass of intended access restrictions. (CVE-2021-4120)
The Qualys Research Team discovered that snapd did not properly validate the location of the snap-confine binary. A local attacker could possibly use this issue to execute other arbitrary binaries and escalate privileges. (CVE-2021-44730)
The Qualys Research Team discovered that a race condition existed in the snapd snap-confine binary when preparing a private mount namespace for a snap. A local attacker could possibly use this issue to escalate privileges and execute arbitrary code. (CVE-2021-44731)
What each source reports
OSV No score
snapd regression
USN-5292-1 fixed a vulnerability in snapd. Unfortunately that update introduced a regression that could break the fish shell. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly use this issue to expose sensitive information. (CVE-2021-3155)
Ian Johnson discovered that snapd did not properly validate content interfaces and layout paths. A local attacker could possibly use this issue to inject arbitrary AppArmor policy rules, resulting in a bypass of intended access restrictions. (CVE-2021-4120)
The Qualys Research Team discovered that snapd did not properly validate the location of the snap-confine binary. A local attacker could possibly use this issue to execute other arbitrary binaries and escalate privileges. (CVE-2021-44730)
The Qualys Research Team discovered that a race condition existed in the snapd snap-confine binary when preparing a private mount namespace for a snap. A local attacker could possibly use this issue to escalate privileges and execute arbitrary code. (CVE-2021-44731)
- Record
USN-5292-4- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snapdUbuntu:Pro:14.04:LTS |
before 2.54.3+14.04.0ubuntu0.1~esm3, plus listed versions 2.21~14.04.22.22.2~14.042.22.3~14.042.22.6~14.042.23.1~14.04 Show 15 moreShow less2.24.1~14.042.25~14.042.26.10~14.042.27.5~14.042.28.5~14.042.29.4.2~14.042.32.3.2~14.042.32.9~14.042.33.1~14.042.34.2~14.042.34.2~14.04.12.37.4~14.04.12.38~14.042.54.3+14.04~esm12.54.3+14.04.0ubuntu0.1~esm2 |
2.54.3+14.04.0ubuntu0.1~esm3 |
snapdUbuntu:Pro:16.04:LTS |
before 2.54.3+16.04.0ubuntu0.1~esm4, plus listed versions 1.91.9.1.11.9.22.02.0.1 Show 45 moreShow less2.0.22.0.32.0.52.0.82.0.92.0.102.11+0.16.042.12+0.16.042.132.14.2~16.042.15.2ubuntu12.16ubuntu32.17.1ubuntu12.20.1ubuntu12.212.22.22.22.32.22.62.23.12.24.12.252.26.102.27.52.28.52.29.4.22.32.3.22.32.92.33.1ubuntu22.34.22.34.2ubuntu0.12.37.42.37.4ubuntu0.12.382.39.22.39.2ubuntu0.22.402.42.12.45.12.45.1ubuntu0.22.46.12.47.12.482.48.32.54.3+16.04~esm22.54.3+16.04.0ubuntu0.1~esm3 |
2.54.3+16.04.0ubuntu0.1~esm4 |
snapdUbuntu:18.04:LTS |
before 2.54.3+18.04.2ubuntu0.2, plus listed versions 2.28.5+17.102.29.4.1+18.042.29.4.2+18.042.31.1+18.042.32+18.04~pre5 Show 28 moreShow less2.32+18.04~pre62.32+18.042.32.3.2+18.042.32.5+18.042.32.8+18.042.32.9+18.042.33.1+18.04ubuntu22.34.2+18.042.34.2+18.04.12.37.1+18.042.37.1.1+18.042.37.4+18.042.37.4+18.04.12.38+18.042.39.2+18.042.40+18.042.42.1+18.042.45.1+18.042.45.1+18.04.22.46.1+18.042.47.1+18.042.48+18.042.48.3+18.042.49.2+18.042.51.1+18.042.54.2+18.04ubuntu12.54.3+18.042.54.3+18.04.2ubuntu0.1 |
2.54.3+18.04.2ubuntu0.2 |
snapdUbuntu:20.04:LTS |
before 2.54.3+20.04.1ubuntu0.2, plus listed versions 2.41+19.10.12.42.1+20.042.43.3+git1.8109f82.44~pre1+20.042.44+20.04 Show 14 moreShow less2.44.2+20.042.44.3+20.042.45.1+20.042.45.1+20.04.22.46.1+20.042.47.1+20.042.48+20.042.48.3+20.042.49.2+20.042.51.1+20.04ubuntu22.54.2+20.04ubuntu22.54.3+20.042.54.3+20.04.12.54.3+20.04.1ubuntu0.1 |
2.54.3+20.04.1ubuntu0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-5292-4 is a vulnerability with no CVSS score yet in snapd, published February 24, 2022. No source lists public exploit code. Fixed in snapd 2.54.3+14.04.0ubuntu0.1~esm3.