Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

blog.qualys.com

Post reply on HN
Print view View original

31–40 of 131 posts

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#31

Post by thayne »

AgentME wrote: post #26

The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common convention for user-specific temp directories on Linux, because a whole class of vulnerabilities could go away. MacOS handles this great by setting $TMPDIR to some /var/folders/.../ directory that's specific to the current user. Linux does have something similar wit…

> I wish there was a common convention for user-specific temp directories on Linux

There kind of is. /run/user/$userId is part of a tmpfs and is owned by the user. But it isn't always used when it should be.

Systemd also has a mechanism to create private /tmp directories for services.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#32

Post by thayne »

ifh-hn wrote: post #4

I wonder if, and this is just speculating not trying to start an arguement, if this sort of thing could have happened in the simpler pre-snap, pre-systemd systems? More to the point is this a cause of using more complicated software?

This isn't really systemd's fault at all. Systemd just happens to be what cleans up /tmp. You would have the same problem with tmpreaper.

The problem is snapd not protecting against something else writing to /tmp.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#33

Post by NekkoDroid »

AgentME wrote: post #26

The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common convention for user-specific temp directories on Linux, because a whole class of vulnerabilities could go away. MacOS handles this great by setting $TMPDIR to some /var/folders/.../ directory that's specific to the current user. Linux does have something similar wit…

> Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), but it's stored in memory only

On a lot (at this point I assume most) of systems /tmp is also just a tmpfs, so it also is just in memory. /var/tmp usually is storage backed though.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#35

Post by IshKebab »

Eh. Definitely not great but until they make it so you can't trivially MitM sudo, I don't think any local privilege execution bugs on Linux are especially notable, at least for most desktop users. Also there's the whole xkcd "at least they can't install drivers" thing.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#36

Post by NekkoDroid »

charcircuit wrote: post #12

When will these distros accept suid was a mistake and disable it. It has lead to critical local privilege escalation exploits so many times.

Probably never for package based distros. I could see it happening for image based distros, where systemd is slowly but surely providing all the building blocks for. It has had the option for `NoNewPrivileges=` in the `system.conf` since v239, so it isn't exactly difficult to disable for the entire system.

Though you'd be surprised how many binaries are suid binaries while they probably shouldn't be (passwd, mount, groupmems, ...), though alot can also work without being suid just more resticted in what they can do.

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#37

Post by zokier »

thayne wrote: post #31
AgentME wrote: post #26

The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common convention for user-specific temp directories on Linux, because a whole class of vulnerabilities could go away. MacOS handles this great by setting $TMPDIR to some /var/folders/.../ directory that's specific to the current user. Linux does have something similar wit…

> I wish there was a common convention for user-specific temp directories on Linux There kind of is. /run/user/$userId is part of a tmpfs and is owned by the user. But it isn't always used when it should be. Systemd also has a mechanism to create private /tmp directories for services.

which of course raises the question why the fuck snap doesn't use either of these mechanisms?

Re: CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

#40

Post by cyberax »

NooneAtAll3 wrote: post #22
ptx wrote: post #3

Better to follow the link to the technical details and just read those: https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-sys... The article linked in the submission is more verbose but less clear and half of it is an advertisement for their product.

I love that cheeky "oh btw, there's also another vulnerability in rust coreutils rewrite, but we aren't talking about that" paragraph

That's because it's not a vulnerability per se. They found a way to use `rm` as a gadget for their privilege escalation.

The core problem is that there's a world-writable directory that is processed by a program running as root.

Post reply on HN