CVE-2015-1338

What it actually does

The vulnerability permits local users to perform symlink or hardlink attacks against /var/crash/vmcore.log during kernel_crashdump processing, enabling arbitrary file writes that result in disk exhaustion or privilege escalation.

Why it matters to the business

Local attackers can cause prolonged system outages through disk consumption or obtain unauthorized elevated access on affected Ubuntu and Apport deployments, increasing operational risk on unpatched systems.

How an attack unfolds

An attacker with local access creates a symlink or hardlink from /var/crash/vmcore.log to a chosen target file. When Apport invokes kernel_crashdump, the write operation follows the link, allowing the attacker to fill disk space or overwrite sensitive files to achieve privilege escalation.

How to fix it

Upgrade Apport to version 2.19 or newer. Apply all available package updates from the distribution vendor for Ubuntu and related systems.

How to confirm the fix worked

Verify the installed Apport version is at least 2.19, confirm absence of unauthorized links under /var/crash, and test crashdump handling with controlled symlinks to ensure writes are rejected.

Typical attack path

1. Obtain local user access on the target system
2. Create a symlink or hardlink targeting /var/crash/vmcore.log
3. Trigger a kernel crash or wait for an existing crashdump event
4. Leverage the resulting file write for denial of service or privilege escalation

How to detect it

Inspect /var/crash for unexpected symlinks or hardlinks to vmcore.log, review Apport and kernel logs for unusual crashdump activity, and correlate high disk I/O on crash paths with local user sessions.

What your security team should do

• Apply the Apport 2.19 update or newer immediately on all affected hosts
• Restrict write access to /var/crash where feasible
• Monitor for anomalous disk usage patterns in crash directories
• Review local user accounts for unnecessary privileges