Open-source package vulnerability · Go
CVE-2022-3328: snapd Race Condition vulnerability
criticalCVSS 4.0 9.0 · 3.1 7.8GHSA-cjqf-877p-7m3f
Race condition in snap-confine's mustmkdirandopenwithperms()
Published Jan 8, 2024 · Updated Nov 18, 2024
Affected packages
github.com/snapcore/snapd
- Ecosystem
- Go
- Affected
- < 2.57.6
- Fixed in
- 2.57.6
- Check
go list -m github.com/snapcore/snapd
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Race condition in snap-confine's must_mkdir_and_open_with_perms()
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-3328
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3328
- https://ubuntu.com/security/notices/USN-5753-1
- https://github.com/snapcore/snapd/pull/12380
- https://github.com/snapcore/snapd/commit/21ebc51f00b8a1417888faa2e83a372fd29d0f5e
- https://github.com/snapcore/snapd/commit/6226cdc57052f4b7057d92f2e549aa169e35cd2d
- https://github.com/advisories/GHSA-cjqf-877p-7m3f
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology