Security Experts:

Connect with us

Hi, what are you looking for?



Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges

Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.

Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.

The new vulnerability, tracked as CVE-2022-3328, is a race condition in Snapd, a Canonical-developed tool used for the Snap software packaging and deployment system. Specifically, the flaw impacts the ‘snap-confine’ program used by Snapd to construct the execution environment for Snap applications.

The affected program is present by default in Ubuntu, whose developers described CVE-2022-3328 as a high-severity flaw that can be exploited for local privilege escalation and arbitrary code execution.

Qualys researchers have shown how CVE-2022-3328 could be combined with other innocuous vulnerabilities for a high-impact attack.

The researchers chained CVE-2022-3328 — this issue was introduced in February 2022 by the patch for a flaw tracked as CVE-2021-44731 — with two recently discovered issues affecting Multipathd. Multipathd is a daemon in charge of checking for failed paths that is running as root in the default installation of Ubuntu and other distributions.

Multipathd is affected by an authorization bypass issue that can be exploited by an unprivileged user to issue privileged commands to Multipathd (CVE-2022-41974), and a symlink attack (CVE-2022-41973) that can be used to force the execution of malicious code.

Chaining the Snapd vulnerability with the two Multipathd flaws can allow any unprivileged user to gain root privileges on a vulnerable device.

“Qualys security researchers have verified the vulnerability, developed an exploit and obtained full root privileges on default installations of Ubuntu,” Qualys said.

The vulnerability is not exploitable remotely, but the cybersecurity firm warns that it’s dangerous because it can be exploited by an unprivileged user.

Qualys has made available an advisory containing technical information, but a proof-of-concept (PoC) exploit is not being released at this time.

The US Cybersecurity and Infrastructure Security Agency (CISA) is aware of more than a dozen Linux vulnerabilities that have been exploited in attacks, including a flaw exploited in the wild by a stealthy Linux malware named Shikitega, and the security hole known as PwnKit.

Related: Polkit Vulnerability Provides Root Privileges on Linux Systems

Related: Google Boosts Bug Bounty Rewards for Linux Kernel Vulnerabilities

Related: ‘DirtyCred’ Vulnerability Haunting Linux Kernel for 8 Years

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.