snapd (Ubuntu)

CVE-2026-3888 – Local Privilege Escalation via Interaction Between snap-confine and systemd-tmpfiles

Affects

• snapd (package managing Snap applications)
• Ubuntu Linux distributions:
  • Ubuntu 16.04 LTS (Xenial)
  • Ubuntu 18.04 LTS (Bionic)
  • Ubuntu 20.04 LTS (Focal)
  • Ubuntu 22.04 LTS (Jammy)
  • Ubuntu 24.04 LTS (Noble)
  • Ubuntu 25.10 (Questing)
  • Ubuntu 26.04 LTS (Resolute – development release)
• Components:
  • snap-confine (SUID-root binary for building snap sandboxes)
  • systemd-tmpfiles (daemon for cleaning temporary directories)
• Files:
  • /tmp/.snap (private directory created by snap-confine)
  • /lib/systemd/system/systemd-tmpfiles*.conf (configuration for temporary directory cleanup)
• Functions:
  • systemd-tmpfiles cleanup routine
  • snap-confine mount namespace initialization

Description

CVE-2026-3888 is a high-severity local privilege escalation vulnerability in snapd, discovered by the Qualys Security Research Team and publicly disclosed on March 17, 2026 . What makes this vulnerability particularly interesting is that it does not stem from a single buggy component, but rather emerges from the interaction of two individually secure programs: snap-confine and systemd-tmpfiles .

snap-confine is a SUID-root binary responsible for building the mount namespace (sandbox) for snap applications. During its operation, it creates a private directory /tmp/.snap owned by root with 0755 permissions . Separately, systemd-tmpfiles is a legitimate system daemon that periodically cleans up stale files and directories in /tmp to prevent disk clutter.

The vulnerability arises when systemd-tmpfiles automatically deletes the stale /tmp/.snap directory after a certain period of inactivity (30 days on Ubuntu 24.04, 10 days on newer versions) . Because /tmp is world-writable, an attacker can detect when this cleanup occurs and recreate the /tmp/.snap directory, but this time owning it with their own user privileges.

After recreating the directory, the attacker uses advanced techniques—including an AF/UNIX backpressure race condition—to single-step snap-confine‘s execution. At the precise moment after snap-confine verifies the directory but before it bind-mounts libraries, the attacker atomically swaps the library directory. snap-confine then bind-mounts the attacker-owned libraries as root into the namespace. By overwriting ld-linux-x86-64.so.2 with custom shellcode, the attacker can cause any SUID binary executed in this namespace to run arbitrary code as root .

The attack culminates in escaping AppArmor confinement (via /var/snap/firefox/common/ or similar paths) to obtain a fully privileged root shell, resulting in complete system compromise .

Attack Vector

Primary Attack Vector:
Local (requires unprivileged user account on the target system)

Attack Scenario:

1. An attacker obtains a low-privileged shell on a vulnerable Ubuntu system (e.g., Ubuntu 24.04 Desktop default installation).
2. The attacker enters a snap sandbox (e.g., by launching firefox or another snap application), and snap-confine creates /tmp/.snap as root:root 0755.
3. The attacker keeps /tmp active with periodic writes but allows the /tmp/.snap directory to go stale (no longer accessed).
4. systemd-tmpfiles eventually deletes the stale /tmp/.snap directory during its periodic cleanup cycle.
5. The attacker detects this deletion and immediately recreates /tmp/.snap—this time owning it as their own user.
6. Using the AF/UNIX backpressure race technique, the attacker precisely times the execution of a new snap application to single-step through snap-confine‘s mount sequence.
7. At the vulnerable moment after snap-confine has validated the directory but before it bind-mounts libraries, the attacker atomically swaps a fake library directory into place.
8. snap-confine bind-mounts the attacker-controlled libraries (with root privileges) into the namespace.
9. The attacker overwrites ld-linux-x86-64.so.2 with custom shellcode—any SUID binary executed in this namespace now runs the attacker’s code as root.
10. The attacker escapes AppArmor confinement via a shared common directory (e.g., /var/snap/firefox/common/), obtaining a fully privileged root shell.

Key Characteristics:

• Attack Complexity: HIGH – Requires precise race condition timing and waiting for the systemd-tmpfiles cleanup cycle (up to 30 days)
• Privileges Required: LOW – Attack starts with any unprivileged user account
• User Interaction: NONE – Once the race is set up, no further user action is needed
• Exploit available: Yes – public educational proof-of-concept exists
• No authentication required – Local system access is sufficient

Conditions Increasing Risk:

• Default Ubuntu Desktop installations (snapd present)
• Systems with long uptime allowing systemd-tmpfiles cleanup cycles to occur
• Systems where local user accounts are accessible to multiple users (shared workstations)
• Lack of timely security updates for snapd

Impact

Successful exploitation allows a local unprivileged attacker to:

• Escalate privileges to root on the affected system
• Execute arbitrary code as root by manipulating the snap sandbox environment
• Escape AppArmor confinement that normally restricts snap applications
• Install persistent backdoors (rootkits, unauthorized users, modified system binaries)
• Modify system files and configurations with full integrity impact
• Access sensitive data across the entire system (other users’ files, credentials, application data)
• Disrupt system availability by manipulating critical system processes
• Use compromised system as a pivot point for lateral movement within enterprise networks

This represents a complete system takeover from an unprivileged starting point. The CVSS scope is marked as CHANGED because the attack escalates from a low-privileged process to the root-level security domain .

Observed Exploitation & Threat Activity

• Discovery and Disclosure: March 17, 2026 – Qualys Security Research Team
• Public Disclosure Date: March 17, 2026
• Patch Availability: Patches released concurrently with disclosure
• Public PoC: Yes – educational proof-of-concept available on GitHub (as of March 2026)
• In-the-Wild Exploitation: No confirmed active exploitation as of publication
• Advisory Published: Ubuntu Security Notice and Qualys advisory
• GitHub Advisory Database: Published by NVD
• CVSS Score: 7.8 (High)

Attack Timeline:

Current Status: Awaiting Analysis (as of March 18, 2026)

Severity & Metrics

• CVSS v3.1 (NVD): High (7.8)
• Attack Vector: LOCAL
• Attack Complexity: HIGH
• Privileges Required: LOW
• User Interaction: NONE
• Scope: CHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH

Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v4.0 (Red Hat): 7.8 (High) – CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N [citation:unknown]

Relevant CWE:

• CWE-268 – Privilege Chaining (combination of two distinct security features allows unsafe actions)
• CAPEC-233 – Privilege Escalation

Patch & Vendor Status

• Official Patches Available: Yes – released March 17, 2026
• Patch Source: Ubuntu Security Notices and snapd upstream
• GitHub Commit: https://github.com/canonical/snapd/commit/5400bfdf1e4c3f861826a215417234420470cb25

Fixed snapd Versions by Ubuntu Release:

Debian Status:

Debian Security Advisory: DSA-6170-1

Mitigation & Remediation

Immediate Actions

Minimum snapd safe versions:

• Ubuntu 24.04: snapd 2.73+ubuntu24.04.2 or later
• Ubuntu 22.04: snapd 2.73+ubuntu22.04.1 or later
• Ubuntu 20.04: snapd 2.67.1+20.04ubuntu1~esm1 or later
• Ubuntu 18.04: snapd 2.61.4ubuntu0.18.04.1+esm2 or later
• Ubuntu 16.04: snapd 2.61.4ubuntu0.16.04.1+esm2 or later

Short-Term Defensive Measures

If patching cannot be applied immediately:

• Restrict local user access – Limit who can log into the system, especially on shared workstations
• Monitor /tmp/.snap directory – Alert on unauthorized creation or ownership changes
• Consider disabling systemd-tmpfiles cleanup for /tmp (advanced, may impact system performance)
• Enforce principle of least privilege – Minimize local user accounts
• Disable snapd if not required – sudo systemctl disable --now snapd (removes snap functionality entirely)

Important Notes:

• The vulnerability requires local access – systems without unprivileged local user access are not at risk
• The attack requires a waiting period (10-30 days) for the cleanup cycle – this provides a detection window
• No workaround addresses the root cause; patching is the only complete solution

Detection & Monitoring

Recommended Detection Sources:

Indicators of Attempted Exploitation:

• Unusual recreation of /tmp/.snap directory by non-root users
• Ownership changes of /tmp/.snap from root to an unprivileged user
• Unexpected snap-confine executions with unusual timing patterns
• Library path manipulation attempts within snap sandboxes
• AppArmor violation logs related to snap confinement escapes
• Unusual child processes spawned from snap applications

Detection Strategy:

1. Inventory snapd versions across all Ubuntu systems:

   snap version | grep snapd
   dpkg -l snapd
   

2. Monitor for vulnerable systems using vulnerability scanners (Nessus, Qualys, OpenVAS)
3. Enable audit rules for /tmp/.snap:

   sudo auditctl -w /tmp/.snap -p wa -k snapd_exploit
   

4. Review logs for systemd-tmpfiles activity on /tmp:

   journalctl -u systemd-tmpfiles-clean.service
   

Deferred to package maintainer for additional detection signatures .

Post-Incident Response

If exploitation is suspected or a system is confirmed vulnerable with evidence of local access by untrusted users:

1. Isolate affected system from the network immediately to prevent lateral movement
2. Preserve forensic evidence – Collect:
   • System logs (/var/log/)
   • snapd logs (journalctl -u snapd)
   • File system timestamps for /tmp/.snap
   • Process execution history
3. Rotate all credentials stored on the compromised system (SSH keys, application secrets, user passwords)
4. Audit for backdoors – Check:
   • SUID binaries modified or added
   • Cron jobs (/etc/crontab, user crontabs)
   • Systemd services
   • SSH authorized_keys files
   • Kernel modules
5. Assume full compromise – Root access means the attacker could have modified any system component
6. Rebuild system from a trusted, clean installation after patching
7. Extend investigation to any systems accessible from the compromised host (network shares, SSH trust relationships)
8. Review other Ubuntu systems in the environment for the same vulnerability
9. Document incident – Timeline, indicators of compromise, affected systems, and response actions

For Enterprise Environments:

• Implement a patch management policy requiring snapd updates within 7 days of release
• Use vulnerability management tools to track CVE-2026-3888 compliance
• Consider restricting local user access on systems that cannot be patched immediately

References

• https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
• https://ubuntu.com/security/CVE-2026-3888
• https://security-tracker.debian.org/tracker/CVE-2026-3888
• https://github.com/advisories/ghsa-grpw-jgrw-ccqr
• https://github.com/nomaisthere/CVE-2026-3888
• https://securitricks.com/cve/CVE-2026-3888
• https://vulnerability.circl.lu/vuln/Cve-2026-3888
• https://asec.ahnlab.com/en/93038/
• https://cvetodo.com/cve/CVE-2026-3888
• https://www.openwall.com/lists/oss-security/2026/03/17/8
• https://bugs.debian.org/1131120
• https://cwe.mitre.org/data/definitions/268.html
• https://capec.mitre.org/data/definitions/233.html