CVE-2022-3328: Canonical Snapd Race Condition Flaw

CVE-2022-3328 Overview

CVE-2022-3328 is a race condition vulnerability in Canonical's snap-confine utility, specifically within the must_mkdir_and_open_with_perms() function. This vulnerability affects the snapd package, which is a core component of Ubuntu systems responsible for managing and confining snap applications. The race condition occurs during directory creation and permission setting operations, potentially allowing local attackers to exploit the timing window between these operations.

Critical Impact

A local attacker with low privileges can exploit this race condition to achieve high impact on confidentiality, integrity, and availability of the affected system, potentially leading to privilege escalation.

Affected Products

• Canonical Snapd (all vulnerable versions)
• Ubuntu Linux 16.04 ESM
• Ubuntu Linux 18.04 ESM
• Ubuntu Linux 20.04 LTS
• Ubuntu Linux 22.04 LTS
• Ubuntu Linux 22.10

Discovery Timeline

• 2024-01-08 - CVE-2022-3328 published to NVD
• 2025-06-03 - Last updated in NVD database

Technical Details for CVE-2022-3328

Vulnerability Analysis

This vulnerability is classified as CWE-362 (Race Condition), a Time-of-Check Time-of-Use (TOCTOU) type flaw in the snap-confine component. The snap-confine utility is a setuid-root program that sets up the execution environment for snap applications. The vulnerable function must_mkdir_and_open_with_perms() is responsible for creating directories with specific permissions during the snap confinement process.

The race condition exists because there is a gap between when the directory is created and when its permissions are properly set. During this window, an attacker with local access could potentially manipulate the directory or its contents, leveraging the elevated privileges of the setuid-root snap-confine binary.

Root Cause

The root cause lies in the non-atomic nature of the directory creation and permission-setting operations within must_mkdir_and_open_with_perms(). When this function creates a directory and subsequently sets its permissions, there exists a brief window where the directory exists but doesn't have the intended security permissions applied. This TOCTOU vulnerability allows an attacker to race against the permission-setting operation, potentially inserting malicious content or symbolic links before permissions are properly enforced.

Attack Vector

The attack requires local access to the system with low-privilege user credentials. An attacker would need to:

1. Monitor or predict when snap-confine operations occur that invoke the vulnerable function
2. Exploit the timing window between directory creation and permission setting
3. Manipulate the filesystem state during this window (e.g., through symbolic link attacks or directory substitution)
4. Leverage the setuid-root nature of snap-confine to escalate privileges or achieve unauthorized access

The vulnerability mechanism targets the race condition in directory operations. During normal snap-confine execution, the must_mkdir_and_open_with_perms() function creates directories as part of setting up the snap execution environment. The attacker exploits the timing gap by rapidly creating symbolic links or manipulating directory entries in the brief window between the mkdir system call and the subsequent permission-setting operations. Due to the setuid-root privileges of snap-confine, successful exploitation can result in operations being performed with root privileges on attacker-controlled paths.

Detection Methods for CVE-2022-3328

Indicators of Compromise

• Unusual snap-confine process activity or crashes indicating potential exploitation attempts
• Suspicious symbolic links in snap-related directories such as /var/snap/ or /tmp/
• Unexpected file permission changes in snap confinement paths
• Evidence of rapid filesystem operations targeting snap directories during snap execution

Detection Strategies

• Monitor for anomalous snap-confine process behavior using process monitoring tools
• Implement file integrity monitoring on critical snap-related directories
• Deploy auditd rules to track mkdir, chmod, and chown operations in snap paths
• Use SentinelOne's behavioral AI to detect privilege escalation attempts following snap operations

Monitoring Recommendations

• Enable audit logging for setuid program executions, particularly snap-confine
• Monitor for rapid successive filesystem operations that could indicate race condition exploitation
• Track symbolic link creation in /tmp/ and snap-related directories
• Implement real-time alerting for privilege escalation patterns on Ubuntu systems

How to Mitigate CVE-2022-3328

Immediate Actions Required

• Update snapd to the latest patched version immediately
• Review system logs for any suspicious snap-confine activity
• Restrict local user access on critical systems until patches are applied
• Monitor for unusual privilege escalation patterns on affected Ubuntu systems

Patch Information

Canonical has released security updates to address this vulnerability. The patch information is available through Ubuntu Security Notice USN-5753-1. System administrators should apply the security updates using the standard package management tools:

For Ubuntu systems, run:

sudo apt update && sudo apt upgrade snapd

Verify the installed snapd version is patched by checking:

snap version

Workarounds

• Limit local user access to trusted accounts only until patching is complete
• Monitor snap-confine execution closely using process monitoring tools
• Consider temporarily disabling snap functionality on highly sensitive systems if feasible
• Implement additional access controls on snap-related directories

# Configuration example
# Enable audit logging for snap-confine operations
sudo auditctl -w /usr/lib/snapd/snap-confine -p x -k snap_confine_exec

# Monitor directory operations in snap paths
sudo auditctl -w /var/snap -p wa -k snap_dir_changes

# Verify snapd version after patching
snap version