CVE:CVE-2021-44730
CNNVD:CNNVD-202202-1420
snapd是开源的一个跨平台的包管理工具。
snapd 2.54.2 版本存在后置链接漏洞，该漏洞源于没有正确验证snap- restricted二进制文件的位置。本地攻击者可利用该漏洞，可以将这个二进制文件硬链接到另一个位置，从而导致snap-限制执行其他任意二进制文件，从而获得特权升级。
solution:Upgrade canonical snapd to a higher version than 2.54.2,and avoid the version (,2.54.2]; Upgrade canonical ubuntu_linux to a higher version than 18.04,20.04,21.10,and avoid the version 18.04,20.04,21.10; Upgrade fedoraproject fedora to a higher version than 34,35,and avoid the version 34,35; Upgrade debian debian_linux to a higher version than 10.0,11.0,and avoid the version 10.0,11.0