Description
The `snap-confine` in some Ubuntu versions is vulnerable to race condition, when setting up snap sandbox and creating mimic of /usr/lib/x86_64-linux-gnu. The snapd package is vulnerable up to version 2.74.1+ubuntu26.04.3 - however, each minor version has its own patch. The time window between creating bind-mounted copies of real libraries and copying them into sandbox /usr/lib/x86_64-linux-gnu allows the attacker to take control of content of those libraries by recreating /tmp/.snap folder. This folder is owned by root, but it's auto-deleted after 30 days without activity (by default on Ubuntu 24.04+). The attacker can recreate this folder once it is deleted and take over the sandboxed libraries. After gaining root inside sandbox, it can escape the sandbox by copying setuid binary into host filesystem.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/local/cve/2026_3888msf undefined(2026_3888) > show actions ...actions...msf undefined(2026_3888) > set ACTION < action-name >msf undefined(2026_3888) > show options ...show and set options...msf undefined(2026_3888) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub