New Ubuntu Desktop Vulnerability Turns Local Access Into Root Control
Qualys researchers have disclosed a high-severity vulnerability in Ubuntu’s snap-confine component that allows an unprivileged local user to gain root access. Tracked as CVE-2026-8933, the flaw can give an attacker complete administrative control of an affected computer.
It is worth noting that the vulnerability does not provide remote access on its own. An attacker must already be able to run commands locally, whether through a compromised account, stolen credentials, another vulnerability, or a malicious application.
Race Condition Abuses Sandbox Setup
Snap-confine is part of snapd, the service that installs and manages snap packages. Its role is to prepare the restricted environment in which a snap application runs.
The vulnerability appeared after a security hardening change replaced snap-confine’s setuid-root design with a Linux capabilities model. Under the newer setup, snap-confine runs using the calling user’s effective identity while retaining permissions needed to configure the sandbox.
During that process, temporary files...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
