The vulnerability arises from the AppArmor profile abstraction rules in /etc/apparmor.d/abstractions/nss-systemd, which inadvertently permit strictly confined snap applications without privileged account-control interface access to interact with systemd UNIX domain sockets. On systems with systemd-userdbd installed and running, the service returns complete user records including sensitive hashed passwords when queried by a root process inside a snap sandbox. This leads to an access control bypass and disclosure of sensitive information (hashed passwords) from /etc/shadow. The issue affects snapd versions before 2.76.1. There is no official remediation level or patch explicitly stated in the advisory, and no known exploits in the wild have been reported.

An attacker who can execute code as root within a strictly confined snap application can bypass sandbox restrictions to query systemd-userdbd and obtain hashed user passwords from /etc/shadow. This compromises the confidentiality of sensitive authentication data. The vulnerability requires local access with some privileges and presence of systemd-userdbd service, which is not installed by default on standard Ubuntu systems, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since systemd-userdbd is not installed by default, systems without this service are not affected. Restrict installation and operation of systemd-userdbd where possible. Monitor vendor communications for updates or patches addressing this vulnerability.