CVE-2021-44731

A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

• CWE-362
• CWE-362

• http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Dec/4Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/18/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/23/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/23/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/11/30/2Exploit, Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/
• https://ubuntu.com/security/notices/USN-5292-1Patch, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5080Issue Tracking, Third Party Advisory
• http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Dec/4Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/18/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/23/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/02/23/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/11/30/2Exploit, Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTBN7LLZISXIA4KU4UKDR27Q5PXDS2U/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGHG6LJAVJJ72TMART6A7N4Z6MSTGI7/
• https://ubuntu.com/security/notices/USN-5292-1Patch, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5080Issue Tracking, Third Party Advisory

Published

Feb 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4472The mistral-dashboard plugin for openstack has a local file …6.5
• CVE-2021-44720In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1…7.2
• CVE-2021-44725KNIME Server before 4.13.4 allows directory traversal in a r…7.5
• CVE-2021-44726KNIME Server before 4.13.4 allows XSS via the old WebPortal …6.1
• CVE-2021-4473Tianxin Internet Behavior Management System contains a comma…9.8
• CVE-2021-44730snapd 2.54.2 did not properly validate the location of the s…8.8
• CVE-2021-44732Mbed TLS before 3.0.1 has a double free in certain out-of-me…9.8
• CVE-2021-44733A use-after-free exists in drivers/tee/tee_shm.c in the TEE …7
• CVE-2021-44734Embedded web server input sanitization vulnerability in Lexm…9.8
• CVE-2021-44735Embedded web server command injection vulnerability in Lexma…9.8
• CVE-2021-44736The initial admin account setup wizard on Lexmark devices al…9.8
• CVE-2021-44737PJL directory traversal vulnerability in Lexmark devices thr…8.8