Linux

When I need to create scratch files I usually operate in /tmp. Almost all directories there that I saw were using randomized paths (e.g. UUIDs). I guess this is to prevent problems mentioned in the article. So, I believe this would be a vulnerability of snap, not systemd.

I use Fedora where /tmp is created as tmpfs, which lives in RAM and is cleared when the system is shut down. I wonder what's the benefit of Ubuntu's approach.

Not a very good article. The original write-up (not linked anywhere in the article) is here: https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root

They also mention something else that's interesting at the bottom of the write-up:

Secondary Finding: Vulnerability in Ubuntu 25.10 uutils Coreutils

In a proactive security effort prior to the release of Ubuntu Desktop 25.10, the Qualys Threat Research Unit assisted the Ubuntu Security Team in reviewing the uutils coreutils package (a Rust rewrite of standard GNU utilities).

A race condition in the rm utility allowed an unprivileged local attacker to replace directory entries with symlinks during root-owned cron executions (specifically /etc/cron.daily/apport). Successful exploitation could lead to arbitrary file deletion as root or further privilege escalation by targeting snap sandbox directories.

The vulnerability was reported and mitigated prior to the public release of Ubuntu 25.10. The default rm command in Ubuntu 25.10 was reverted to GNU coreutils to mitigate this risk immediately. Upstream fixes have since been applied to the uutils repository.

how would i know if Kubuntu 25.10 is affected (based on ubuntu)?
i guess this means yes?
command 'snap' from deb snapd (2.73+ubuntu25.10.1)
as it is lower than the version mentioned in the article "Upstream snapd: versions prior to 2.75"

now the question is how do i force an update on that thing?
sudo apt upgrade did not include an update for snapd:

Upgrading:
bpftool linux-headers-generic linux-libc-dev linux-tools-common
linux-generic linux-image-generic linux-perf

Installing dependencies:
linux-headers-6.17.0-20 linux-image-6.17.0-20-generic linux-tools-6.17.0-20
linux-headers-6.17.0-20-generic linux-modules-6.17.0-20-generic linux-tools-6.17.0-20-generic

Suggested packages:
linux-tools

Not upgrading yet due to phasing:
fwupd libfwupd3

Summary:
Upgrading: 7, Installing: 6, Removing: 0, Not Upgrading: 2
Download size: 212 MB
Space needed: 421 MB / 417 GB available

edit:
i tried sudo apt install snapd but it returned:

snapd is already the newest version (2.73+ubuntu25.10.1).
snapd set to manually installed.

edit2:
or am i save because of this?:

Ubuntu 25.10 LTS: snapd versions prior to 2.73+ubuntu25.10.1

Yet another critical vulnerability in systemd

This is a critical vulnerability in snapd, not systemd. It sounds like it could also be exploited if something other than systemd deleted the files in /tmp/. Or if /tmp/ was not mounted.

No Dylan, don't bother fixing this shit, go straight for the boot licking commit.

Snap back to reality