TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains two complete, multi-phase exploit implementations (SUID and Capabilities variants) for CVE-2026-3888 that achieve local privilege escalation to root by winning a TOCTOU race condition between snap-confine and systemd-tmpfiles.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two C source files implementing a local privilege escalation exploit for CVE-2026-3888. The code performs the documented exploit steps: entering a snap sandbox, waiting for a directory cleanup, winning a TOCTOU race against snap-confine, and planting a payload to obtain root privileges. All behavior is consistent with the stated purpose of demonstrating the vulnerability. No concealed backdoor, unrelated remote access, credential theft, persistence mechanism, or deceptive payload targeting the person running the PoC was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesC
Target softwaresnapdsnap-confinesystemd-tmpfiles
Attack typesLocal Privilege EscalationTOCTOU Race Condition
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, compilable C source code (exploit_suid.c and exploit_caps.c) that implements a multi-phase attack chain designed to exercise the CVE-2026-3888 vulnerability and achieve local privilege escalation to root. The README documents the exploit steps, build instructions, and expected output showing a root shell. This is code intended to exploit a vulnerability, not merely detect or analyze it.

exploit_suid.c:1-717exploit_caps.c:1-757README.md:1-362

Requirements

  • Unprivileged local user access on Ubuntu 24.04+ with unpatched snapd (< 2.74.2)README.md:99
  • snap-confine must be SUID-root (Variant 1) or have specific capabilities (Variant 2)README.md:100README.md:231
  • A snap with layout bind-mounts installed (firefox for SUID, snap-store for Capabilities)README.md:101README.md:232
  • systemd-tmpfiles-clean.timer must be activeREADME.md:102
  • busybox must be available on the targetREADME.md:103

Observed behavior

  • Enters a snap sandbox (firefox or snap-store) and waits for systemd-tmpfiles to delete the stale /tmp/.snap directoryexploit_suid.c:302-340exploit_suid.c:350-394
  • Destroys the cached mount namespace to force snap-confine to rebuild it from scratchexploit_suid.c:404-421
  • Creates a controlled .snap directory tree and races snap-confine by monitoring its stderr via an AF_UNIX socket, swapping directories when a trigger string is detectedexploit_suid.c:148-292
  • Injects a payload (overwrites ld-linux-x86-64.so.2 or sets up ld.so.preload) into the poisoned namespace to execute arbitrary code as rootexploit_suid.c:461-516exploit_caps.c:504-552
  • Triggers root execution by invoking snap-confine again, which loads the attacker-controlled library with elevated privileges, resulting in a SUID root bash shellexploit_suid.c:527-551exploit_suid.c:560-605
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The code performs a multi-phase local privilege escalation by exploiting a race condition in snap-confine.All actions (sandbox entry, directory manipulation, race condition exploitation, payload injection, and root shell execution) are consistent with the documented CVE-2026-3888 exploit.exploit_suid.c:1-717exploit_caps.c:1-757README.md:1-362
Review boundaries

What the analysis did not establish

  • Two files (librootshell_suid.c and librootshell_caps.c) are referenced in the README and build instructions but are not included in the supplied evidence packets. The analysis is based on the three provided text files (README.md, exploit_suid.c, exploit_caps.c).
  • The evidence packet reports complete_artifact_coverage as false and notes 2 unclassified files (likely the missing payload source files) that were not analyzed.
  • Two files (librootshell_suid.c and librootshell_caps.c) are referenced in the README and build instructions but were not included in the supplied text evidence. Their content could not be reviewed.
  • The analysis is limited to the supplied text; no binary analysis or dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1