The vulnerability exists in the AppArmor profile abstraction rules for snapd, specifically in /etc/apparmor.d/abstractions/nss-systemd, which permit strictly confined snap applications without privileged account-control interface access to interact with io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems with systemd-userdbd installed and running, this service fails to differentiate between unconfined root and restricted root users, returning complete user records including hashed passwords from /etc/shadow when queried via the Varlink interface. Consequently, a compromised or malicious strictly confined snap running as root can bypass sandbox restrictions to obtain sensitive password hashes. The issue is partially mitigated by the absence of systemd-userdbd in default Ubuntu installations.

An attacker controlling a strictly confined snap application running as root can bypass sandbox restrictions to access sensitive hashed user passwords from /etc/shadow via systemd-userdbd's Varlink interface. This leads to information disclosure of password hashes, potentially enabling offline password cracking and further system compromise. The impact is limited to systems where systemd-userdbd is installed and operational.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation currently relies on the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments. Administrators should verify whether systemd-userdbd is installed and consider removing or restricting it if not required. Monitor vendor advisories for updates or official fixes addressing this vulnerability.