7 ms·

CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

161 points by askl 7mo ago

cyberpunk 7mo ago
[flagged]
- delamon 7mo ago
  Rust cannot help you if race condition crosses API boundary. No matter what language you use, you have to think about system as a whole. Failure to do that results in bugs like this
  - bangaladore 7mo ago
    The bigger problem here is it seems like the rust utilities were rushed to be released without extensive testing or security analysis because simply because they are written in rust. And this isn't the first serious flaw because of that. Doesn't surprise me coming from Canonical though. At least that's the vibe I'm getting from [1] and definitely [2] [1] https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-sys... [2] https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bug/2111815 https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bu...
    - yjftsjthsd-h 7mo ago
      The best discussion I can find for the official reasons for switching is https://discourse.ubuntu.com/t/carefully-but-purposefully-oxidising-ubuntu/56995 https://discourse.ubuntu.com/t/carefully-but-purposefully-ox... - > But… why? > Performance is a frequently cited rationale for “Rewrite it in Rust” projects. While performance is high on my list of priorities, it’s not the primary driver behind this change. These utilities are at the heart of the distribution - and it’s the enhanced resilience and safety that is more easily achieved with Rust ports that are most attractive to me. > The Rust language, its type system and its borrow checker (and its community!) work together to encourage developers to write safe, sound, resilient software. With added safety comes an increase in security guarantees, and with an increase in security comes an increase in overall resilience of the system - and where better to start than with the foundational tools that build the distribution? So yes, it sounds like the primary official reason is "enhanced resilience and safety". Given that, I would be interested in seeing the number of security problems in each implementation over time. GNU coreutils does have problems from time to time, but... https://app.opencve.io/cve/?product=coreutils&vendor=gnu https://app.opencve.io/cve/?product=coreutils&vendor=gnu only seems to list 10 CVEs since 2005. Unfortunately I can't find an equivalent for uutils, but just from news coverage I'm pretty sure they have a worse track record thus far.
      - someothherguyy 7mo ago
        probably because many of those tools were around for 20ish years before 2005
        collinfunk 7mo ago
        fileutils-1.0 was released in 1990 [1]. shellutils-1.0 was released in 1991 [2], and textutils-1.0 was released a month later in the same year [3]. Those three packages were combined into coreutils-5.0 in 2003 [4]. [1] https://groups.google.com/g/gnu.utils.bug/c/CviP42X_hCY/m/YssXFn-JrX4J https://groups.google.com/g/gnu.utils.bug/c/CviP42X_hCY/m/Ys... [2] https://groups.google.com/g/gnu.utils.bug/c/xpTRtuFpNQc/m/mRc_7JWZ0BYJ https://groups.google.com/g/gnu.utils.bug/c/xpTRtuFpNQc/m/mR... [3] https://groups.google.com/g/gnu.utils.bug/c/iN5KuoJYRhU/m/V_6oiBAWF0EJ https://groups.google.com/g/gnu.utils.bug/c/iN5KuoJYRhU/m/V_... [4] https://lists.gnu.org/archive/html/info-gnu/2003-04/msg00000.html https://lists.gnu.org/archive/html/info-gnu/2003-04/msg00000...
        yjftsjthsd-h 7mo ago
        Could be. The thing is, it kinda doesn't matter; what matters is, what will result in the least bugs/vulnerabilities now? To which I argue the answer is, keeping GNU coreutils. I don't care that they have a head start, I care that they're ahead.
        lifeisstillgood 7mo ago
        >>> I don't care that they have a head start, I care that they're ahead. Nice
        IshKebab 7mo ago
        That's short sighted. The least number of bugs now isn't the only thing that matters. What about in 5 years from now? 10 years? That matters too. To me it seems inarguable that eventually uutils will have fewer bugs than coreutils, and also making uutils the default will clearly accelerate that. So I don't think it's so easy to dismiss. I think they were probably still a little premature, but not by much. I'd probably have waited one more release.
    - staticassertion 7mo ago
      It's extremely early to say if things are rushed or not. It's unsurprising that newer software has an influx of vulnerabilities initially, it'll be a matter of retrospectively evaluating this after that time period has passed.
      - Terr_ 7mo ago
        > influx of vulnerabilities initially https://en.wikipedia.org/wiki/Bathtub_curve https://en.wikipedia.org/wiki/Bathtub_curve It's a little different with software since you don't usually have the code or silicon wearing out, but aging software does start to have a mismatch with the way people are trying to use it and the things it has to interact with, which leads to a similar rise of "failure" in the end.
  - l-albertovich 7mo ago
    It's not even about API boundaries, it's about logic and the language isn't really responsible for that. Expecting it to prevent it would be as gullible as expecting it to prevent a toctou or any other type of non trivial vulnerability. That's why even though I appreciate the role of these slightly safer languages I still have a bit of a knee-jerk reaction to the exagerated claims of their benefits and how much of a piece of crap C is. Spoiler, crappy programmers write crappy code regardless of the language so maybe we should focus on teaching students to think of the code they're writing from a different perspective and focus safety and maintainability rather than "flashiness"
  - TZubiri 7mo ago
    [flagged]
    - stevenhuang 7mo ago
      Yeah we get it you don't like rust and you want everyone to know how weird you are by tearing down asinine arguments no one actually made. How boring.
      - TZubiri 7mo ago
        [flagged]
        stevenhuang 7mo ago
        > based on ignorance and naivety. About as nuanced as your bait framing of what a mere language ought/can do. Oh you're a python backend developer, guess that explains it.
        TZubiri 7mo ago
        So I was saying that rust monolithicism is NOT based on ignorance and naivety. Do you see what I mean by nuance? I think you just glanced at the comment, saw that there were negative words around rust, and you lossy compressed into "Rust bad".
        staticassertion 7mo ago
        Your post is very badly written. It's confusing and starts off with a totally weird comment about wasting revolutionary capacity. Expect downvotes.
        deleted 7mo ago
        [deleted]
- dgxyz 7mo ago
  Rewrite tools in new language, get new exciting bugs!
  - hedora 7mo ago
    That's optimistic. Use a search engine to find: JWZ CADT
    - dgxyz 7mo ago
      Very good point
- unethical_ban 7mo ago
  Is a race condition a memory related error?
  - tialaramex 7mo ago
    No. Race conditions are a normal part of our world, in the same way it's not a memory error if you coded the discount feature so that people can apply more than one 10% off coupon to an order and as a result the nine different "10% off" offers that marketing seeded have summed to a 90% discount which bankrupts you. An example race condition would be Mike and Sarah both wake up, notice there's no milk and decide to grab milk on the way home that evening, they both work a full day, drop past the store and arrive home with a carton of milk. But, now there are two cartons of milk, which is too much milk. Oops. This is called a "Time of Check versus Time of Use" race or ToCToU race. (Safe) Rust does prevent Data Races which can be seen as a specific very weird type of Race Condition, unlike other race conditions a Data Race reflects a difference between how humans understand computers in order to write computer software and how the machine actually works. Humans are used to experiencing a world in which things happen in order. We write software for that intuitive world, this is called "Sequential consistency". A happens before B, or B happens before A, one of these must be true. Mustn't it? But actually a modern multi-core CPU cannot afford sequential consistency, we give that up for more speed, so any appearance of sequential consistency in concurrent software is an illusion for our comfort. (Safe) Rust promises the illusion is maintained, if you try to shatter it the compiler is going to say "No", languages like C or C++ just say well, if you accidentally destroy the illusion your program might do absolutely anything at all, good luck with that.
    - ndsipa_pomu 7mo ago
      I like your idea of illustrating a race condition with buying milk - that should become the default method of explaining them. (Either that or bartenders serving customers which is my usual method of understanding work queues)
  - nurettin 7mo ago
    It can be about any resource. You get it when two concurrent functions access the resource without a queue, atomic operation or wait, and one of them modifies it.
- TZubiri 7mo ago
  > (a Rust rewrite of the standard GNU coreutils -- ls, cp, rm, cat, sort, etc), which are installed by default in Ubuntu 25.10. 0 benefits and only risks involved. Users are forced to choose between a worse new version or an older version that will no longer be supported. Like SystemD all over again. It feels like there is a phenomenon where software devs (especially Open Source) have to keep developing even when just doing nothing would result in a better product. Like there's some monetization incentives to keep touching the thing so that you can get paid.
ptx 7mo ago
Better to follow the link to the technical details and just read those: https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-sys... The article linked in the submission is more verbose but less clear and half of it is an advertisement for their product.
- cadamsdotcom 7mo ago
  This. Might be worth updating the link.
- NooneAtAll3 7mo ago
  I love that cheeky "oh btw, there's also another vulnerability in rust coreutils rewrite, but we aren't talking about that" paragraph
  - cyberax 7mo ago
    That's because it's not a vulnerability per se. They found a way to use `rm` as a gadget for their privilege escalation. The core problem is that there's a world-writable directory that is processed by a program running as root.
    - l-albertovich 7mo ago
      It's a race condition that can be used as a primitive to achieve privilege escalation which makes it legitimate but even if it you couldn't use it for anything else but to trick the system into acting on a directory it didn't meant to it would still be a valid vulnerability (regardless of the application). Claiming it's not a valid bug would be similar to claiming an infoleak isn't as well when it's one of the building blocks of modern exploitation. I'm not trying to be an ass, I'm just trying to add a bit of context to ensure that the implication is well understood.
  - nine_k 7mo ago
    But this vulnerability is enabled by a very creative exploitation of the complicated bind mounting scheme used by snap-confine. Just reading about these mounts between /usr/lib to /tmp and back triggered my sense of a potential security vulnerability.
ifh-hn 7mo ago
I wonder if, and this is just speculating not trying to start an arguement, if this sort of thing could have happened in the simpler pre-snap, pre-systemd systems? More to the point is this a cause of using more complicated software?
- dogleash 7mo ago
  Permission and timing gotchas in /tmp predate snap and systemd. It's why things like `mkstemp` exist. I remember cron jobs that did what systemd-tmpfiles-clean does before it existed. All unix daemons using /tmp run the risk of misusing /tmp. I don't know snap well enough to say anything about it makes it uniquely more susceptible to that.
  - SoftTalker 7mo ago
    The mistake seems to be using a predictable path (/tmp/.snap) in a publicly-writable directory.
    - pbhjpbhj 7mo ago
      The exploit doesn't rely on the path being predictable though. As I read it the .snap is expired and pruned, then the exploiter makes their own .snap in /tmp, then snap-confine assumes that the new .snap is the old one and executes with elevated privileges. So, the path can be from mkstemp, or a sha-256 of your significant others fingerprint, it doesn't matter; until it expires it's plaintext in the /tmp listing. {Wild, ignorant speculation follows ... hashing the inode and putting a signed file in the folder bearing that hash, then checking for that ... something that works but along those lines might be appropriate. (We know the inode for the 10 days we're waiting for /tmp/.snap to get pruned; time that might be used to generate a hash collision, so my off-the-cuff suggestion is definitely no good. It feels like there's a simple solution but everything I can think of fails to KPA, I think -- perhaps just use dm-crypt for the /tmp/.snap folder?}
      - SoftTalker 7mo ago
rglover 7mo ago
Semi-related: does anybody know of a reliable API that announces CVEs as they're published? Edit: for others who may be curious https://www.cve.org/Downloads https://www.cve.org/Downloads
- Teapot112358 7mo ago
  They publish on GitHub now https://github.com/CVEProject/cvelistV5 https://github.com/CVEProject/cvelistV5 If you need metadata added by NVD, NVD website documents their API.
- mynameajeff 7mo ago
  We have notifications set up at my job for criticals and I quickly have learned how many 10.0 CVE's are related to random IoT devices that I can't even find via google.
charcircuit 7mo ago
When will these distros accept suid was a mistake and disable it. It has lead to critical local privilege escalation exploits so many times.
- wmf 7mo ago
  Around 20 years after suid is deprecated.
- NekkoDroid 7mo ago
  Probably never for package based distros. I could see it happening for image based distros, where systemd is slowly but surely providing all the building blocks for. It has had the option for `NoNewPrivileges=` in the `system.conf` since v239, so it isn't exactly difficult to disable for the entire system. Though you'd be surprised how many binaries are suid binaries while they probably shouldn't be (passwd, mount, groupmems, ...), though alot can also work without being suid just more resticted in what they can do.
  - yjftsjthsd-h 7mo ago
    > how many binaries are suid binaries while they probably shouldn't be (passwd I would expect an unprivileged user to be able to change their own password. How else would that work?
    - kam 7mo ago
      Send a message to a socket-activated daemon running as a UID with write access to the password database.
      - linsomniac 7mo ago
        Isn't the issue in this case caused not by suid, but by a daemon running as root reading files from a tmp dir? Seems like a socket-activated daemon wouldn't solve this specific case.
      - deleted 7mo ago
capitainenemo 7mo ago
It is possible to just not use snap on ubuntu. The few ubuntu servers we have, even the couple with a minimal XFCE interface for some gui pieces, don't have snap installed. I realise local exploits happen all the time, but why add a whole new huge surface area if I don't have to.
- himata4113 7mo ago
  use debootstrap to install instead, chroot is your friend. It comes with nothing and I mean that literally while still having the superior ubuntu kernel.
- gertrunde 7mo ago
  It can be done, but it is quite irritating with the way that canonical have made snap a dependency in the minimal meta package. (And minimal on Ubuntu is really really super minimal, doesn't even have ping. Well apart from snap anyway). They really went out of their way to make it awkward and annoying to take snap out.
- zokier 7mo ago
  But why bother running Ubuntu at all just to jump through hoops to avoid snaps? Snaps are obviously Ubuntus the thing, so feels counterproductive to run Ubuntu and fight against it.
  - capitainenemo 7mo ago
    Most of our servers are Debian (well, mine are Devuan) but there are a few that have to be Ubuntu or Redhat for official support of COTS. Of those choices, I prefer Ubuntu as being closer to the Debian/Devuan ones.
sysops9x 7mo ago
The frustrating part is that Snap's confinement story was supposed to be a selling point. Here we are with a priv-esc in the daemon itself. At this point I've just disabled snapd on all our Ubuntu boxes and moved to flatpak or building from source. The attack surface of a privileged install daemon that parses arbitrary package manifests is just too broad.
- fmajid 6mo ago
  Then you need to plan a migration away from Ubuntu, as Canonical is embedding Snap so deep in 26.04 it probably won't be usable with snapd disabled, e.g. no sound because Pipewire will be shipped as a snap. That's why I started experimenting with CachyOS.
Neskenfrederi44 7mo ago
[flagged]
AgentME 7mo ago
The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common convention for user-specific temp directories on Linux, because a whole class of vulnerabilities could go away. MacOS handles this great by setting $TMPDIR to some /var/folders/.../ directory that's specific to the current user. Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), though it's stored in memory only which is a little different from usual for /tmp/, seemingly mainly intended for small stuff like unix sockets.
- thayne 7mo ago
  > I wish there was a common convention for user-specific temp directories on Linux There kind of is. /run/user/$userId is part of a tmpfs and is owned by the user. But it isn't always used when it should be. Systemd also has a mechanism to create private /tmp directories for services.
  - zokier 7mo ago
    which of course raises the question why the fuck snap doesn't use either of these mechanisms?
- NekkoDroid 7mo ago
  > Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), but it's stored in memory only On a lot (at this point I assume most) of systems /tmp is also just a tmpfs, so it also is just in memory. /var/tmp usually is storage backed though.
broadsidepicnic 7mo ago
Well, fuck snaps, that is. Even though I've used ubuntu since 6.04, fuck snaps. I'm still stuck on Ubuntu even after 20 years. But fuck snaps.
- zokier 7mo ago
  Why are you stuck on Ubuntu, what is holding you back?
goatyishere25 7mo ago
[flagged]
thayne 7mo ago
Why does snap-confine need to be setuid, rather than use a user namespace?
- curt15 7mo ago
  Snap supports programs running as real root. Would those work with user namespaces?
- cello305 7mo ago
  [dead]
- zyga 7mo ago
  There are several reasons but at some point we can use user namespaces to remove them. I'm not particularly a HN person so I won't go into details but it's possible to drop the setuid bits sooner rather than later.
IshKebab 7mo ago
Eh. Definitely not great but until they make it so you can't trivially MitM sudo, I don't think any local privilege execution bugs on Linux are especially notable, at least for most desktop users. Also there's the whole xkcd "at least they can't install drivers" thing.
- cello305 7mo ago
  [dead]
kev009 7mo ago
I always wonder why Ubuntu is even on the radar anymore. It is a pile of questionable decisions with a billionaire ego bus factor. If you like apt, just use Debian. sid is fine for desktops if you are moderately technical.
- hedora 7mo ago
  Debian is almost as broken as Ubuntu. However, I've been extremely happy with Devuan. It is Debian minus some bad decisions the Ubuntu voting block forced upstream (for instance, there's no systemd).
- linsomniac 7mo ago
  >Ubuntu is even on the radar anymore The biggest thing that has prevented me from switching prod systems to Debian is that the window for updates is fairly small, at around a year. 13 came out Aug 9, 2025, and 12 goes EOL June 10, 2026. Compared to Ubuntu 24.04 coming out in April 2024, and 22.04 goes EOL in May 2027 (a year after 24.04). So Ubuntu covers 2 releases plus a year. I know a lot of people feel like this isn't a big deal, but even with Ansible it can be hard to get our fleet of a few hundred machines all upgraded in a year window, being already busy. Some of them are easy, of course, but there are some that take significant time and also involve developer work, etc... Don't get me wrong, I think Debian is great. But in the data center, there's definitely a case for a longer support window, and I like that about Ubuntu. RHEL is even better for that, but it is very nice that Ubuntu free and Ubuntu commercial are the same, but with RHEL there is that split to CentOS being the free one (haven't used RHELs in quite a while, obviously).
  - kev009 7mo ago
    Except their LTS is a lie or maybe plausible deniability for businesses that DGAF. They have no idea what they are doing with backports and lack thereof. And if you aren't paying you aren't even receiving many of the updates.
    - bboozzoo 7mo ago
      > And if you aren't paying you aren't even receiving many of the updates. Are you sure you didn't mean RedHat? Last I checked there's no requirement to pay anything in order to use an LTS release of Ubuntu. Even if you go with Pro to get those extra years of Extended Support (to make it ~12 years?) you still get up to 5 licenses for personal use. No money asked, no *BS* subscription model. Isn't that more than enough any non-commercial user?
deleted 7mo ago
[deleted]
aidenn0 7mo ago
systemd-tmpfiles bugs the heck out of me. It breaks so many applications for absolutely no good reason. A typical system of mine not running it gathers less than 1GiB per year of uptime in /tmp with disk sizes measured in TB. Even if you are /tmp on a 256GB NVME, that's less than 1% of your total disk per year of uptime. If you upgrade to alternating Ubuntu LTS editions (which requires a reboot every 4 years) systemd-tmpfiles will save you a maximum of 4GB of disk space.
- hedora 7mo ago
  If you care about slow tmp leaks, you could also just use a 1-line, decade+ old solution; no additional software required, since your machine already has cron, find and xargs on it: https://askubuntu.com/questions/431058/using-a-cronjob-to-clean-tmp https://askubuntu.com/questions/431058/using-a-cronjob-to-cl... If you miss that "will this eat my system?" adrenaline rush you get from systemd-tmpfiles, you could just use cron + find, but replace xargs with the -delete option.
- linsomniac 7mo ago
  >which requires a reboot every 4 years We have a monitoring check and once a system reaches 200 days of uptime we start scheduling a reboot. Because you KNOW there are kernel and library updates that are probably hanging around on disc but not in memory. I used to be an uptime snob, but I've decided it does more harm than good. Slightly related: A coworker was doing a RAM upgrade on a Sun box. I suggested that before they cracked the hardware open, they first shut it down, and then power it back on, just to make sure it would. So they wouldn't go chasing down a RAM upgrade issue when it was the system itself. I want to say that this system had years of uptime since it was last rebooted, let alone powered off. He was very glad I suggested that, because it indeed did not come back up after the power cycle.
balinha_8864 7mo ago
[dead]
dhsorens79 7mo ago
[dead]
prthgo33 7mo ago
[dead]
usr1106 7mo ago
I don't like snap and have always uninstalled it in the past. However, that gets more difficult in newer releases, so probably not a sustainable path. Still searching for the distro I could install instead of Xubuntu for friends and family who don't want or need the latest and greatest. The main reason for my dislike is the closed source nature of snap distribution. App isolation is important and not easy. That bugs will happen and be fixed there is natural. Happens with every other system that was supposed to increase security, too.
- Xiol 7mo ago
  Worth looking at Fedora. Been using it for work and play for over a decade and it's never let me down. Absolutely solid.
  - usr1106 7mo ago
    I know Fedora, although haven't used it recently anymore because it's not approved at my current job. But is that something to use by non-geeks on really low end machines?
- throwa356262 7mo ago
  I love multipass. It is a simple no BS virtualization solution and probably the best thing to come out of Ubuntu after LXD. But I can't use it. You know why? Because despite being open source Canonical wont tell you how to compile it and install it as a standalone program. Instead all their documentation says "install via snap"... even if your are on fedora or debian or arch: https://github.com/canonical/multipass https://github.com/canonical/multipass Snap needs to die, it is hurting everybody including canonical
  - fulafel 7mo ago
    They do document how to build and run, in the OS specific build docs. Eg this: https://github.com/canonical/multipass/blob/main/BUILD.linux.md https://github.com/canonical/multipass/blob/main/BUILD.linux... I think pointing end users to use the end user packaged app is fine, as is to trust people who are comfortable with building from source to find the build docs from the repo.
TifoWorks52 7mo ago
[dead]

161 points by askl 7mo ago

cyberpunk 7mo ago

[flagged]

delamon 7mo ago
Rust cannot help you if race condition crosses API boundary. No matter what language you use, you have to think about system as a whole. Failure to do that results in bugs like this
- bangaladore 7mo ago
  The bigger problem here is it seems like the rust utilities were rushed to be released without extensive testing or security analysis because simply because they are written in rust. And this isn't the first serious flaw because of that. Doesn't surprise me coming from Canonical though. At least that's the vibe I'm getting from [1] and definitely [2] [1] https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-sys... [2] https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bug/2111815 https://bugs.launchpad.net/ubuntu/+source/rust-coreutils/+bu...
  - yjftsjthsd-h 7mo ago
    The best discussion I can find for the official reasons for switching is https://discourse.ubuntu.com/t/carefully-but-purposefully-oxidising-ubuntu/56995 https://discourse.ubuntu.com/t/carefully-but-purposefully-ox... - > But… why? > Performance is a frequently cited rationale for “Rewrite it in Rust” projects. While performance is high on my list of priorities, it’s not the primary driver behind this change. These utilities are at the heart of the distribution - and it’s the enhanced resilience and safety that is more easily achieved with Rust ports that are most attractive to me. > The Rust language, its type system and its borrow checker (and its community!) work together to encourage developers to write safe, sound, resilient software. With added safety comes an increase in security guarantees, and with an increase in security comes an increase in overall resilience of the system - and where better to start than with the foundational tools that build the distribution? So yes, it sounds like the primary official reason is "enhanced resilience and safety". Given that, I would be interested in seeing the number of security problems in each implementation over time. GNU coreutils does have problems from time to time, but... https://app.opencve.io/cve/?product=coreutils&vendor=gnu https://app.opencve.io/cve/?product=coreutils&vendor=gnu only seems to list 10 CVEs since 2005. Unfortunately I can't find an equivalent for uutils, but just from news coverage I'm pretty sure they have a worse track record thus far.
    - someothherguyy 7mo ago
      probably because many of those tools were around for 20ish years before 2005
      - collinfunk 7mo ago
        fileutils-1.0 was released in 1990 [1]. shellutils-1.0 was released in 1991 [2], and textutils-1.0 was released a month later in the same year [3]. Those three packages were combined into coreutils-5.0 in 2003 [4]. [1] https://groups.google.com/g/gnu.utils.bug/c/CviP42X_hCY/m/YssXFn-JrX4J https://groups.google.com/g/gnu.utils.bug/c/CviP42X_hCY/m/Ys... [2] https://groups.google.com/g/gnu.utils.bug/c/xpTRtuFpNQc/m/mRc_7JWZ0BYJ https://groups.google.com/g/gnu.utils.bug/c/xpTRtuFpNQc/m/mR... [3] https://groups.google.com/g/gnu.utils.bug/c/iN5KuoJYRhU/m/V_6oiBAWF0EJ https://groups.google.com/g/gnu.utils.bug/c/iN5KuoJYRhU/m/V_... [4] https://lists.gnu.org/archive/html/info-gnu/2003-04/msg00000.html https://lists.gnu.org/archive/html/info-gnu/2003-04/msg00000...
      - yjftsjthsd-h 7mo ago
        Could be. The thing is, it kinda doesn't matter; what matters is, what will result in the least bugs/vulnerabilities now? To which I argue the answer is, keeping GNU coreutils. I don't care that they have a head start, I care that they're ahead.
        lifeisstillgood 7mo ago
        >>> I don't care that they have a head start, I care that they're ahead. Nice
        IshKebab 7mo ago
        That's short sighted. The least number of bugs now isn't the only thing that matters. What about in 5 years from now? 10 years? That matters too. To me it seems inarguable that eventually uutils will have fewer bugs than coreutils, and also making uutils the default will clearly accelerate that. So I don't think it's so easy to dismiss. I think they were probably still a little premature, but not by much. I'd probably have waited one more release.
  - staticassertion 7mo ago
    It's extremely early to say if things are rushed or not. It's unsurprising that newer software has an influx of vulnerabilities initially, it'll be a matter of retrospectively evaluating this after that time period has passed.
    - Terr_ 7mo ago
      > influx of vulnerabilities initially https://en.wikipedia.org/wiki/Bathtub_curve https://en.wikipedia.org/wiki/Bathtub_curve It's a little different with software since you don't usually have the code or silicon wearing out, but aging software does start to have a mismatch with the way people are trying to use it and the things it has to interact with, which leads to a similar rise of "failure" in the end.
- l-albertovich 7mo ago
  It's not even about API boundaries, it's about logic and the language isn't really responsible for that. Expecting it to prevent it would be as gullible as expecting it to prevent a toctou or any other type of non trivial vulnerability. That's why even though I appreciate the role of these slightly safer languages I still have a bit of a knee-jerk reaction to the exagerated claims of their benefits and how much of a piece of crap C is. Spoiler, crappy programmers write crappy code regardless of the language so maybe we should focus on teaching students to think of the code they're writing from a different perspective and focus safety and maintainability rather than "flashiness"
- TZubiri 7mo ago
  [flagged]
  - stevenhuang 7mo ago
    Yeah we get it you don't like rust and you want everyone to know how weird you are by tearing down asinine arguments no one actually made. How boring.
    - TZubiri 7mo ago
      [flagged]
      - stevenhuang 7mo ago
        > based on ignorance and naivety. About as nuanced as your bait framing of what a mere language ought/can do. Oh you're a python backend developer, guess that explains it.
        TZubiri 7mo ago
        So I was saying that rust monolithicism is NOT based on ignorance and naivety. Do you see what I mean by nuance? I think you just glanced at the comment, saw that there were negative words around rust, and you lossy compressed into "Rust bad".
        staticassertion 7mo ago
        Your post is very badly written. It's confusing and starts off with a totally weird comment about wasting revolutionary capacity. Expect downvotes.
      - deleted 7mo ago
        [deleted]
dgxyz 7mo ago
Rewrite tools in new language, get new exciting bugs!
- hedora 7mo ago
  That's optimistic. Use a search engine to find: JWZ CADT
  - dgxyz 7mo ago
    Very good point
unethical_ban 7mo ago
Is a race condition a memory related error?
- tialaramex 7mo ago
  No. Race conditions are a normal part of our world, in the same way it's not a memory error if you coded the discount feature so that people can apply more than one 10% off coupon to an order and as a result the nine different "10% off" offers that marketing seeded have summed to a 90% discount which bankrupts you. An example race condition would be Mike and Sarah both wake up, notice there's no milk and decide to grab milk on the way home that evening, they both work a full day, drop past the store and arrive home with a carton of milk. But, now there are two cartons of milk, which is too much milk. Oops. This is called a "Time of Check versus Time of Use" race or ToCToU race. (Safe) Rust does prevent Data Races which can be seen as a specific very weird type of Race Condition, unlike other race conditions a Data Race reflects a difference between how humans understand computers in order to write computer software and how the machine actually works. Humans are used to experiencing a world in which things happen in order. We write software for that intuitive world, this is called "Sequential consistency". A happens before B, or B happens before A, one of these must be true. Mustn't it? But actually a modern multi-core CPU cannot afford sequential consistency, we give that up for more speed, so any appearance of sequential consistency in concurrent software is an illusion for our comfort. (Safe) Rust promises the illusion is maintained, if you try to shatter it the compiler is going to say "No", languages like C or C++ just say well, if you accidentally destroy the illusion your program might do absolutely anything at all, good luck with that.
  - ndsipa_pomu 7mo ago
    I like your idea of illustrating a race condition with buying milk - that should become the default method of explaining them. (Either that or bartenders serving customers which is my usual method of understanding work queues)
- nurettin 7mo ago
  It can be about any resource. You get it when two concurrent functions access the resource without a queue, atomic operation or wait, and one of them modifies it.
TZubiri 7mo ago
> (a Rust rewrite of the standard GNU coreutils -- ls, cp, rm, cat, sort, etc), which are installed by default in Ubuntu 25.10. 0 benefits and only risks involved. Users are forced to choose between a worse new version or an older version that will no longer be supported. Like SystemD all over again. It feels like there is a phenomenon where software devs (especially Open Source) have to keep developing even when just doing nothing would result in a better product. Like there's some monetization incentives to keep touching the thing so that you can get paid.

ptx 7mo ago

Better to follow the link to the technical details and just read those: https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-sys... The article linked in the submission is more verbose but less clear and half of it is an advertisement for their product.

cadamsdotcom 7mo ago
This. Might be worth updating the link.
NooneAtAll3 7mo ago
I love that cheeky "oh btw, there's also another vulnerability in rust coreutils rewrite, but we aren't talking about that" paragraph
- cyberax 7mo ago
  That's because it's not a vulnerability per se. They found a way to use `rm` as a gadget for their privilege escalation. The core problem is that there's a world-writable directory that is processed by a program running as root.
  - l-albertovich 7mo ago
    It's a race condition that can be used as a primitive to achieve privilege escalation which makes it legitimate but even if it you couldn't use it for anything else but to trick the system into acting on a directory it didn't meant to it would still be a valid vulnerability (regardless of the application). Claiming it's not a valid bug would be similar to claiming an infoleak isn't as well when it's one of the building blocks of modern exploitation. I'm not trying to be an ass, I'm just trying to add a bit of context to ensure that the implication is well understood.
- nine_k 7mo ago
  But this vulnerability is enabled by a very creative exploitation of the complicated bind mounting scheme used by snap-confine. Just reading about these mounts between /usr/lib to /tmp and back triggered my sense of a potential security vulnerability.

ifh-hn 7mo ago

I wonder if, and this is just speculating not trying to start an arguement, if this sort of thing could have happened in the simpler pre-snap, pre-systemd systems? More to the point is this a cause of using more complicated software?

dogleash 7mo ago
Permission and timing gotchas in /tmp predate snap and systemd. It's why things like `mkstemp` exist. I remember cron jobs that did what systemd-tmpfiles-clean does before it existed. All unix daemons using /tmp run the risk of misusing /tmp. I don't know snap well enough to say anything about it makes it uniquely more susceptible to that.
- SoftTalker 7mo ago
  The mistake seems to be using a predictable path (/tmp/.snap) in a publicly-writable directory.
  - pbhjpbhj 7mo ago
    The exploit doesn't rely on the path being predictable though. As I read it the .snap is expired and pruned, then the exploiter makes their own .snap in /tmp, then snap-confine assumes that the new .snap is the old one and executes with elevated privileges. So, the path can be from mkstemp, or a sha-256 of your significant others fingerprint, it doesn't matter; until it expires it's plaintext in the /tmp listing. {Wild, ignorant speculation follows ... hashing the inode and putting a signed file in the folder bearing that hash, then checking for that ... something that works but along those lines might be appropriate. (We know the inode for the 10 days we're waiting for /tmp/.snap to get pruned; time that might be used to generate a hash collision, so my off-the-cuff suggestion is definitely no good. It feels like there's a simple solution but everything I can think of fails to KPA, I think -- perhaps just use dm-crypt for the /tmp/.snap folder?}
    - SoftTalker 7mo ago

rglover 7mo ago

Semi-related: does anybody know of a reliable API that announces CVEs as they're published? Edit: for others who may be curious https://www.cve.org/Downloads https://www.cve.org/Downloads

Teapot112358 7mo ago
They publish on GitHub now https://github.com/CVEProject/cvelistV5 https://github.com/CVEProject/cvelistV5 If you need metadata added by NVD, NVD website documents their API.
mynameajeff 7mo ago
We have notifications set up at my job for criticals and I quickly have learned how many 10.0 CVE's are related to random IoT devices that I can't even find via google.

charcircuit 7mo ago

When will these distros accept suid was a mistake and disable it. It has lead to critical local privilege escalation exploits so many times.

wmf 7mo ago
Around 20 years after suid is deprecated.
NekkoDroid 7mo ago
Probably never for package based distros. I could see it happening for image based distros, where systemd is slowly but surely providing all the building blocks for. It has had the option for `NoNewPrivileges=` in the `system.conf` since v239, so it isn't exactly difficult to disable for the entire system. Though you'd be surprised how many binaries are suid binaries while they probably shouldn't be (passwd, mount, groupmems, ...), though alot can also work without being suid just more resticted in what they can do.
- yjftsjthsd-h 7mo ago
  > how many binaries are suid binaries while they probably shouldn't be (passwd I would expect an unprivileged user to be able to change their own password. How else would that work?
  - kam 7mo ago
    Send a message to a socket-activated daemon running as a UID with write access to the password database.
    - linsomniac 7mo ago
      Isn't the issue in this case caused not by suid, but by a daemon running as root reading files from a tmp dir? Seems like a socket-activated daemon wouldn't solve this specific case.
    - deleted 7mo ago

capitainenemo 7mo ago

It is possible to just not use snap on ubuntu. The few ubuntu servers we have, even the couple with a minimal XFCE interface for some gui pieces, don't have snap installed. I realise local exploits happen all the time, but why add a whole new huge surface area if I don't have to.

himata4113 7mo ago
use debootstrap to install instead, chroot is your friend. It comes with nothing and I mean that literally while still having the superior ubuntu kernel.
gertrunde 7mo ago
It can be done, but it is quite irritating with the way that canonical have made snap a dependency in the minimal meta package. (And minimal on Ubuntu is really really super minimal, doesn't even have ping. Well apart from snap anyway). They really went out of their way to make it awkward and annoying to take snap out.
zokier 7mo ago
But why bother running Ubuntu at all just to jump through hoops to avoid snaps? Snaps are obviously Ubuntus the thing, so feels counterproductive to run Ubuntu and fight against it.
- capitainenemo 7mo ago
  Most of our servers are Debian (well, mine are Devuan) but there are a few that have to be Ubuntu or Redhat for official support of COTS. Of those choices, I prefer Ubuntu as being closer to the Debian/Devuan ones.

sysops9x 7mo ago

The frustrating part is that Snap's confinement story was supposed to be a selling point. Here we are with a priv-esc in the daemon itself. At this point I've just disabled snapd on all our Ubuntu boxes and moved to flatpak or building from source. The attack surface of a privileged install daemon that parses arbitrary package manifests is just too broad.

fmajid 6mo ago
Then you need to plan a migration away from Ubuntu, as Canonical is embedding Snap so deep in 26.04 it probably won't be usable with snapd disabled, e.g. no sound because Pipewire will be shipped as a snap. That's why I started experimenting with CachyOS.

Neskenfrederi44 7mo ago

[flagged]

AgentME 7mo ago

The shared /tmp/ directory that can be used by processes of multiple users seems extremely prone to causing this type of issue. I wish there was a common convention for user-specific temp directories on Linux, because a whole class of vulnerabilities could go away. MacOS handles this great by setting $TMPDIR to some /var/folders/.../ directory that's specific to the current user. Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), though it's stored in memory only which is a little different from usual for /tmp/, seemingly mainly intended for small stuff like unix sockets.

thayne 7mo ago
> I wish there was a common convention for user-specific temp directories on Linux There kind of is. /run/user/$userId is part of a tmpfs and is owned by the user. But it isn't always used when it should be. Systemd also has a mechanism to create private /tmp directories for services.
- zokier 7mo ago
  which of course raises the question why the fuck snap doesn't use either of these mechanisms?
NekkoDroid 7mo ago
> Linux does have something similar with $XDG_RUNTIME_DIR (generally /run/user/$UID/), but it's stored in memory only On a lot (at this point I assume most) of systems /tmp is also just a tmpfs, so it also is just in memory. /var/tmp usually is storage backed though.

broadsidepicnic 7mo ago

Well, fuck snaps, that is. Even though I've used ubuntu since 6.04, fuck snaps. I'm still stuck on Ubuntu even after 20 years. But fuck snaps.

zokier 7mo ago
Why are you stuck on Ubuntu, what is holding you back?

goatyishere25 7mo ago

[flagged]

thayne 7mo ago

Why does snap-confine need to be setuid, rather than use a user namespace?

curt15 7mo ago
Snap supports programs running as real root. Would those work with user namespaces?
cello305 7mo ago
[dead]
zyga 7mo ago
There are several reasons but at some point we can use user namespaces to remove them. I'm not particularly a HN person so I won't go into details but it's possible to drop the setuid bits sooner rather than later.

IshKebab 7mo ago

Eh. Definitely not great but until they make it so you can't trivially MitM sudo, I don't think any local privilege execution bugs on Linux are especially notable, at least for most desktop users. Also there's the whole xkcd "at least they can't install drivers" thing.

cello305 7mo ago
[dead]

kev009 7mo ago

I always wonder why Ubuntu is even on the radar anymore. It is a pile of questionable decisions with a billionaire ego bus factor. If you like apt, just use Debian. sid is fine for desktops if you are moderately technical.

hedora 7mo ago
Debian is almost as broken as Ubuntu. However, I've been extremely happy with Devuan. It is Debian minus some bad decisions the Ubuntu voting block forced upstream (for instance, there's no systemd).
linsomniac 7mo ago
>Ubuntu is even on the radar anymore The biggest thing that has prevented me from switching prod systems to Debian is that the window for updates is fairly small, at around a year. 13 came out Aug 9, 2025, and 12 goes EOL June 10, 2026. Compared to Ubuntu 24.04 coming out in April 2024, and 22.04 goes EOL in May 2027 (a year after 24.04). So Ubuntu covers 2 releases plus a year. I know a lot of people feel like this isn't a big deal, but even with Ansible it can be hard to get our fleet of a few hundred machines all upgraded in a year window, being already busy. Some of them are easy, of course, but there are some that take significant time and also involve developer work, etc... Don't get me wrong, I think Debian is great. But in the data center, there's definitely a case for a longer support window, and I like that about Ubuntu. RHEL is even better for that, but it is very nice that Ubuntu free and Ubuntu commercial are the same, but with RHEL there is that split to CentOS being the free one (haven't used RHELs in quite a while, obviously).
- kev009 7mo ago
  Except their LTS is a lie or maybe plausible deniability for businesses that DGAF. They have no idea what they are doing with backports and lack thereof. And if you aren't paying you aren't even receiving many of the updates.
  - bboozzoo 7mo ago
    > And if you aren't paying you aren't even receiving many of the updates. Are you sure you didn't mean RedHat? Last I checked there's no requirement to pay anything in order to use an LTS release of Ubuntu. Even if you go with Pro to get those extra years of Extended Support (to make it ~12 years?) you still get up to 5 licenses for personal use. No money asked, no *BS* subscription model. Isn't that more than enough any non-commercial user?

deleted 7mo ago

[deleted]

aidenn0 7mo ago

systemd-tmpfiles bugs the heck out of me. It breaks so many applications for absolutely no good reason. A typical system of mine not running it gathers less than 1GiB per year of uptime in /tmp with disk sizes measured in TB. Even if you are /tmp on a 256GB NVME, that's less than 1% of your total disk per year of uptime. If you upgrade to alternating Ubuntu LTS editions (which requires a reboot every 4 years) systemd-tmpfiles will save you a maximum of 4GB of disk space.

hedora 7mo ago
If you care about slow tmp leaks, you could also just use a 1-line, decade+ old solution; no additional software required, since your machine already has cron, find and xargs on it: https://askubuntu.com/questions/431058/using-a-cronjob-to-clean-tmp https://askubuntu.com/questions/431058/using-a-cronjob-to-cl... If you miss that "will this eat my system?" adrenaline rush you get from systemd-tmpfiles, you could just use cron + find, but replace xargs with the -delete option.
linsomniac 7mo ago
>which requires a reboot every 4 years We have a monitoring check and once a system reaches 200 days of uptime we start scheduling a reboot. Because you KNOW there are kernel and library updates that are probably hanging around on disc but not in memory. I used to be an uptime snob, but I've decided it does more harm than good. Slightly related: A coworker was doing a RAM upgrade on a Sun box. I suggested that before they cracked the hardware open, they first shut it down, and then power it back on, just to make sure it would. So they wouldn't go chasing down a RAM upgrade issue when it was the system itself. I want to say that this system had years of uptime since it was last rebooted, let alone powered off. He was very glad I suggested that, because it indeed did not come back up after the power cycle.

balinha_8864 7mo ago

[dead]

dhsorens79 7mo ago

[dead]

prthgo33 7mo ago

[dead]

usr1106 7mo ago

I don't like snap and have always uninstalled it in the past. However, that gets more difficult in newer releases, so probably not a sustainable path. Still searching for the distro I could install instead of Xubuntu for friends and family who don't want or need the latest and greatest. The main reason for my dislike is the closed source nature of snap distribution. App isolation is important and not easy. That bugs will happen and be fixed there is natural. Happens with every other system that was supposed to increase security, too.

Xiol 7mo ago
Worth looking at Fedora. Been using it for work and play for over a decade and it's never let me down. Absolutely solid.
- usr1106 7mo ago
  I know Fedora, although haven't used it recently anymore because it's not approved at my current job. But is that something to use by non-geeks on really low end machines?
throwa356262 7mo ago
I love multipass. It is a simple no BS virtualization solution and probably the best thing to come out of Ubuntu after LXD. But I can't use it. You know why? Because despite being open source Canonical wont tell you how to compile it and install it as a standalone program. Instead all their documentation says "install via snap"... even if your are on fedora or debian or arch: https://github.com/canonical/multipass https://github.com/canonical/multipass Snap needs to die, it is hurting everybody including canonical
- fulafel 7mo ago
  They do document how to build and run, in the OS specific build docs. Eg this: https://github.com/canonical/multipass/blob/main/BUILD.linux.md https://github.com/canonical/multipass/blob/main/BUILD.linux... I think pointing end users to use the end user packaged app is fine, as is to trust people who are comfortable with building from source to find the build docs from the repo.

TifoWorks52 7mo ago

[dead]