Timing Flaw in systemd Cleanup Enables Root Privilege Escalation

5 months ago by cm0002 to c/linux

A critical Ubuntu vulnerability (CVE-2026-3888) allows attackers to gain root access through a systemd cleanup timing flaw. Learn how it works and how to fix it.

Yet another critical vulnerability in systemd, this time involving snapd. Ubuntu folk are affected.

"A serious security issue has been discovered in Ubuntu, and it is gaining attention in the cybersecurity community. The vulnerability is identified as CVE-2026-3888 and mainly affects Ubuntu Desktop systems from version 24.04 onwards. This flaw is dangerous because it allows an attacker with limited access to gain full root privileges. Root access means complete control over the entire system."

ChaosMonkey 15 points 5 months ago

Oh snap!

save

path: 0 22987285, hotness: undefined, score: 15, children: 0

eleijeep 3 points 5 months ago

https://blog.qualys.com/...

save

path: 0 22991865, hotness: undefined, score: 3, children: 0

randamumaki -1 points 5 months ago

Why did people move away from sysvinit again?

save

path: 0 22991679, hotness: undefined, score: -1, children: 3

LiveLM 14 points 5 months ago

Reading the post, the issue is more on Snap's side and the way Ubuntu configures it than on Systemd.

Ubuntu automatically deletes old files from the /tmp directory after a certain number of days. During this cleanup, an important directory used by snap-confine may get removed. This creates an opportunity for the attacker to act. Once the directory is deleted, the attacker quickly recreates it with malicious content.

In this scenario, a cron job could trigger it too.

save

path: 0 22991679 22992133, hotness: undefined, score: 14, children: 2

randamumaki 7 points 5 months ago

Ah, well, yet another mark against using snap then. My bad. Thanks for letting me know. :)

save

path: 0 22991679 22992133 22993830, hotness: undefined, score: 7, children: 0

30p87 3 points 5 months ago

And that's why you use at least very basic owner/group and mod permission validation on internal files

save

path: 0 22991679 22992133 22994836, hotness: undefined, score: 3, children: 0