CVE-2021-4120: Canonical Snapd

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Affected products

• Canonical Snapd: up to and including 2.54.2
• Canonical Ubuntu Linux: version 18.04 only; version 20.04 only; version 21.10 only
• Fedoraproject Fedora: version 34 only; version 35 only

Published 2022-02-17. Last modified 2026-06-17.