Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

blog.qualys.com

Post reply on HN
Print view View original

121–130 of 131 posts

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#121

Post by kev009 »

linsomniac wrote: post #115
kev009 wrote: post #38

I always wonder why Ubuntu is even on the radar anymore. It is a pile of questionable decisions with a billionaire ego bus factor. If you like apt, just use Debian. sid is fine for desktops if you are moderately technical.

>Ubuntu is even on the radar anymore The biggest thing that has prevented me from switching prod systems to Debian is that the window for updates is fairly small, at around a year. 13 came out Aug 9, 2025, and 12 goes EOL June 10, 2026. Compared to Ubuntu 24.04 coming out in April 2024, and 22.04 goes EOL in May 2027 (a year after 24.04). So Ubuntu covers 2 releases plus a year. I know a lot of people feel like this…

Except their LTS is a lie or maybe plausible deniability for businesses that DGAF. They have no idea what they are doing with backports and lack thereof. And if you aren't paying you aren't even receiving many of the updates.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#122

Post by capitainenemo »

zokier wrote: post #45
capitainenemo wrote: post #13

It is possible to just not use snap on ubuntu. The few ubuntu servers we have, even the couple with a minimal XFCE interface for some gui pieces, don't have snap installed. I realise local exploits happen all the time, but why add a whole new huge surface area if I don't have to.

But why bother running Ubuntu at all just to jump through hoops to avoid snaps? Snaps are obviously Ubuntus the thing, so feels counterproductive to run Ubuntu and fight against it.

Most of our servers are Debian (well, mine are Devuan) but there are a few that have to be Ubuntu or Redhat for official support of COTS.

Of those choices, I prefer Ubuntu as being closer to the Debian/Devuan ones.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#123

Post by [deleted] »

kam wrote: post #76
yjftsjthsd-h wrote: post #72

Earlier quoted context omitted.

> how many binaries are suid binaries while they probably shouldn't be (passwd I would expect an unprivileged user to be able to change their own password. How else would that work?

Send a message to a socket-activated daemon running as a UID with write access to the password database.

[deleted]

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#124

Post by Vogtinator »

NekkoDroid wrote: post #36
charcircuit wrote: post #12

When will these distros accept suid was a mistake and disable it. It has lead to critical local privilege escalation exploits so many times.

Probably never for package based distros. I could see it happening for image based distros, where systemd is slowly but surely providing all the building blocks for. It has had the option for `NoNewPrivileges=` in the `system.conf` since v239, so it isn't exactly difficult to disable for the entire system. Though you'd be surprised how many binaries are suid binaries while they probably shouldn't be (passwd, mount, g…

With https://github.com/thkukuk/account-utils (not the default yet), it's meanwhile possible to run openSUSE Tumbleweed (package based) with NoNewPrivileges= as usual.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#125

Post by bboozzoo »

kev009 wrote: post #121
linsomniac wrote: post #115

Earlier quoted context omitted.

>Ubuntu is even on the radar anymore The biggest thing that has prevented me from switching prod systems to Debian is that the window for updates is fairly small, at around a year. 13 came out Aug 9, 2025, and 12 goes EOL June 10, 2026. Compared to Ubuntu 24.04 coming out in April 2024, and 22.04 goes EOL in May 2027 (a year after 24.04). So Ubuntu covers 2 releases plus a year. I know a lot of people feel like this…

Except their LTS is a lie or maybe plausible deniability for businesses that DGAF. They have no idea what they are doing with backports and lack thereof. And if you aren't paying you aren't even receiving many of the updates.

> And if you aren't paying you aren't even receiving many of the updates.

Are you sure you didn't mean RedHat? Last I checked there's no requirement to pay anything in order to use an LTS release of Ubuntu. Even if you go with Pro to get those extra years of Extended Support (to make it ~12 years?) you still get up to 5 licenses for personal use. No money asked, no *BS* subscription model. Isn't that more than enough any non-commercial user?

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#126

Post by kev009 »

bboozzoo wrote: post #125
kev009 wrote: post #121

Earlier quoted context omitted.

Except their LTS is a lie or maybe plausible deniability for businesses that DGAF. They have no idea what they are doing with backports and lack thereof. And if you aren't paying you aren't even receiving many of the updates.

> And if you aren't paying you aren't even receiving many of the updates. Are you sure you didn't mean RedHat? Last I checked there's no requirement to pay anything in order to use an LTS release of Ubuntu. Even if you go with Pro to get those extra years of Extended Support (to make it ~12 years?) you still get up to 5 licenses for personal use. No money asked, no *BS* subscription model. Isn't that more than enough…

Read https://ubuntu.com/security/esm carefully. The chance of running everything out of 'main' is close to zero. I am shocked by how little people understand this.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#127

Post by bboozzoo »

kev009 wrote: post #126
bboozzoo wrote: post #125

Earlier quoted context omitted.

> And if you aren't paying you aren't even receiving many of the updates. Are you sure you didn't mean RedHat? Last I checked there's no requirement to pay anything in order to use an LTS release of Ubuntu. Even if you go with Pro to get those extra years of Extended Support (to make it ~12 years?) you still get up to 5 licenses for personal use. No money asked, no *BS* subscription model. Isn't that more than enough…

Read https://ubuntu.com/security/esm carefully. The chance of running everything out of 'main' is close to zero. I am shocked by how little people understand this.

Main is all you need to set up a working system and deploy services. Much like BaseOS in RHEL you get full support for those packages for 5+5 years. With snaps you effectively get rolling releases of LXD, microk8s, openstack, docker and other relevant things. What else do you need? Seriously, how come this isn't enough for a non commercial user?

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#128

Post by kev009 »

bboozzoo wrote: post #127
kev009 wrote: post #126

Earlier quoted context omitted.

Read https://ubuntu.com/security/esm carefully. The chance of running everything out of 'main' is close to zero. I am shocked by how little people understand this.

Main is all you need to set up a working system and deploy services. Much like BaseOS in RHEL you get full support for those packages for 5+5 years. With snaps you effectively get rolling releases of LXD, microk8s, openstack, docker and other relevant things. What else do you need? Seriously, how come this isn't enough for a non commercial user?

Because this is Stockholm syndrome, better community options prevail, main is not all people deploy and is not the only repo default enabled. openstack, docker are legacy tech, never encountered anyone using LXD or microk8s thankfully I'll steer clear of that snap garbage barge.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#129

Post by yencabulator »

fc417fc802 wrote: post #79
nine_k wrote: post #65

Earlier quoted context omitted.

But this vulnerability is enabled by a very creative exploitation of the complicated bind mounting scheme used by snap-confine. Just reading about these mounts between /usr/lib to /tmp and back triggered my sense of a potential security vulnerability.

Slightly tangential but I never ended up switching to nix (or guix) precisely because I don't fully understand the theory behind why things were done the way they were done and where the security boundaries are supposed to lie relative to a "regular" distro. I found plenty of prescriptive documentation giving me recipes to do anything I might be interested in doing but not much in the way of design documents explaini…

NixOS is incredibly complicated at build time, but the filesystem & runtime state is pretty simple. Run it in a VM and look around, there's very little magic at runtime; the trickery is mostly in the build time rpath hack to load shared libs from the specific /nix/store paths, and a lot of configuring software to read files from specific /nix/store paths.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#130

Post by fmajid »

usr1106 wrote: post #120
Jnr wrote: post #107

Earlier quoted context omitted.

Yes, Debian is great. But there is also Arch by the way :)

Sure, I like Arch. Did not consider it for completely non-technical users, though.

CachyOS gets close, including for gamers, but it is not as stable as Ubuntu.
Post reply on HN