Document-Linux-Privilege-Escalation

Linux 権限昇格（snapd 経由） プロジェクトの目的： Canonical の snapd デーモン（Ubuntu Linux のデフォルトサービス）の REST API における「DirtySock」（CVE-2019-7304）と呼ばれる脆弱性を悪用して、root アクセスを取得します。 Ramil Mustafayev のガイド:...

dirty_sock

dirtysock snapd（CVE-2019-7304）を介したローカル権限昇格 リマスタードPoCエクスプロイト クレジット: initstring 氏。オリジナル: dirtysock 使用方法 スクリプトを再実行する前に約40秒待ってください。待たないと失敗します。 chmod u+x lpe.py ./lpe.py...

dirty_sock

dirtysock: Linux 権限昇格 snapd 経由 2019年1月、当時の Ubuntu Linux の現行バージョンが snapd API のバグによりローカル権限昇格の脆弱性の影響を受けることが判明しました。このリポジトリには、研究および教育用に公開されているオリジナルのエクスプロイト POC が含まれています。脆弱性とエクスプロイトの詳細なウォークスルーについては、 こちらのブログ投稿を参照してください。 Ubuntu には snapd...

snap_priv_esc

snapprivesc snapd を介した Linux 権限昇格エクスプロイトの別の実装 CVE-2019-7304 snap とは？ Snap は、Canonical によって Linux カーネルを使用する オペレーティングシステム 向けに開発されたソフトウェアの パッケージング および デプロイメント システムです。これらのパッケージは snaps と呼ばれ、それを使用するツールである snapd は、さまざまな Linux ディストリビューション で動作し、上流 ソフトウェア開発者がアプリケーションをユーザーに直接配布できるようにします。Snaps...

HTB-Snapped-Writeup

HTB-Snapped-Writeup HTB Snapped — 困难级 Linux 机器 writeup。CVE-2026-27944（Nginx UI 未认证备份泄露）与 CVE-2026-3888（snapd 竞态条件 LPE）链式利用，实现完全系统入侵。 HTB: Snapped — Writeup 难度： 困难 操作系统： Linux Ubuntu 24.04 发布日期： 2026年3月23日 CVE： CVE-2026-27944, CVE-2026-3888 摘要 Snapped 是一台困难级 Linux 机器，托管着一个位于 nginx 之后的静态站点，并带有 Ngin...

CVE-2026-3888-POC-all-from-the-Qualys-platform.

CVE-2026-3888: snapd 本地权限提升 PoC 针对 snapd 中本地权限提升漏洞（CVE-2026-3888）的概念验证。该漏洞允许本地非特权攻击者在受影响的 Ubuntu 系统上，通过在 systemd-tmpfiles 删除私有目录 /tmp/.snap 后重新创建该目录，将权限提升至 root。 📋 漏洞概述 ID: CVE-2026-3888 产品: snapd 受影响系统: Ubuntu 16.04 LTS、18.04 LTS、20.04 LTS、22.04 LTS 和 24.04 LTS（及更高版本） CWE-ID: CWE-268（权限链） 严重性（CV...

CVE-2026-8933

A flaw was found in snap-confine, a core component of Canonical snapd. This vulnerability allows a local, unprivileged attacker to bypass security restrictions and execute arbitrary code. The flaw occurs due to an issue in how privilege boundaries are initialized when snap-confine operates with...

The vulnerability of the Snapd service in Ubuntu operating systems allows attackers to escalate their privileges.

The vulnerability of the Snapd service in Ubuntu operating systems is related to errors in privilege management. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2024-5300

A flaw was found in Canonical snapd. The base AppArmor security profile configuration in snapd inadvertently allows strictly confined snap applications to bypass intended sandbox restrictions. This enables a compromised or malicious snap application, when running as root, to access sensitive syst...

Linux Distros Unpatched Vulnerability : CVE-2024-5300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction...

Linux Distros Unpatched Vulnerability : CVE-2026-15226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp securi...

Linux Distros Unpatched Vulnerability : CVE-2026-8933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure...

New Ubuntu Desktop Vulnerability Turns Local Access Into Root Control

A vulnerability in snap-confine lets an unprivileged user gain root access on affected Ubuntu Desktop systems. Install the latest snapd update to fix the issue...

CVE-2026-8933

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilitie...

CVE-2026-15226

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...

CVE-2024-5300

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

USN-8579-1: snapd vulnerabilities

James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. CVE-2024-5300 Qualys discovered that snap-confine can be tricked to create...

EUVD-2026-46262

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilitie...

CVE-2026-8933

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilitie...

CVE-2026-8933

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilitie...