CVE-2026-3888

CVE-2026-3888 - snap-confine + systemd-tmpfiles 本地权限提升 免责声明： 本仓库仅用于教育目的 。所有内容均基于 Qualys 于 2026 年 3 月 17 日发布的原始安全公告。该漏洞已被修复——请始终确保您的系统保持最新状态。请勿将本材料用于您不拥有或未经明确书面许可测试的系统。 概述 CVE-2026-3888 是一个影响 Ubuntu Desktop = 24.04 默认安装的本地权限提升（LPE）漏洞。该漏洞由 Qualys 于 2026 年 3 月发现并公开披露。 正如 Qualys...

CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE

CVE-2026-3888 — snap-confine / systemd-tmpfiles 本地权限提升 通过利用 snap-confine 与 systemd-tmpfiles 之间的 TOCTOU 竞态条件，在 Ubuntu Desktop 24.04+ 上实现从非特权用户到完全 root 的本地权限提升。提供两种变体：SUID 和 Capabilities 。 CVSS: 7.8（高危） | 公告： Qualys | 补丁： snapd 2.74.2，2026年3月17日 目录 变体对比 变体 1 — SUID 工作原理 文件 构建 使用方法 环境要求 输出 变体 2 —...

CVE-2026-3888-POC-all-from-the-Qualys-platform.

CVE-2026-3888: snapd 本地权限提升 PoC 针对 snapd 中本地权限提升漏洞（CVE-2026-3888）的概念验证。该漏洞允许本地非特权攻击者在受影响的 Ubuntu 系统上，通过在 systemd-tmpfiles 删除私有目录 /tmp/.snap 后重新创建该目录，将权限提升至 root。 📋 漏洞概述 ID: CVE-2026-3888 产品: snapd 受影响系统: Ubuntu 16.04 LTS、18.04 LTS、20.04 LTS、22.04 LTS 和 24.04 LTS（及更高版本） CWE-ID: CWE-268（权限链） 严重性（CV...

CVE-2026-3888

CVE-2026-3888 - snap-confine + systemd-tmpfiles Escalação de Privilégios Local Aviso: Este repositório é apenas para fins educacionais. Todo o conteúdo é baseado no aviso de segurança original publicado pela Qualys em 17 de março de 2026. A vulnerabilidade já foi corrigida — garanta sempre que se...

CVE-2026-16552

REJECTED A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats...

CVE-2026-16552

Rejected reason: The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component...

DEBIAN-CVE-2026-16552

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away...

CVE-2026-16552

Removed by vendor...

CVE-2026-16552

...

EUVD-2026-47736

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away...

CVE-2026-16552

The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component...

CVE-2026-16552

...

CVE-2026-16552

The CVE-2026-16552 entries describe a vulnerability in systemd-tmpfiles: when processing tmpfiles.d entries that write to a file, an unprivileged local user can cause systemd-tmpfiles to follow a symbolic link, potentially redirecting a privileged write to an attacker-controlled file. The highest...

PT-2026-63427

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away...

Security update 5.1.4 for Multi-Linux Manager Client Tools and Salt Bundle

Description: This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security issues fixed: CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-prometheus-nodeexporter updated to version...

SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:2438-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2438-1 advisory. This update for alloy fixes the following issues Security issues: - CVE-2026-4427: github.com/jackc/pgproto3/v...

SUSE-SU-2026:2438-1 Security update for alloy

This update for alloy fixes the following issues Security issues: - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message bsc1259919. - CVE-2026-25934: github.com/go-git/go-git/v5:...

Security update 5.0.8 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security Fixes: CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter bsc1248707 golang-github-prometheus-nodeexporter: Backward Compatibility and packaging changes: Added compatibility for Go...

OPENSUSE-SU-2026:20752-1 Security update for alloy

This update for alloy fixes the following issues Security issues: - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message bsc1259919. - CVE-2026-25934: github.com/go-git/go-git/v5:...

SUSE-SU-2026:21793-1 Security update for alloy

This update for alloy fixes the following issues Security issues: - CVE-2026-4427: github.com/jackc/pgproto3/v2: improper validation of field length allows a malicious PostgreSQL server to crash a client application via a DataRow message bsc1259919. - CVE-2026-25934: github.com/go-git/go-git/v5:...