CVE-2017-14177

What it actually does

Apport fails to sanitize core dumps originating from setuid binaries, permitting a local process to direct the creation of arbitrary files with root ownership and permissions; the incomplete remediation of CVE-2015-1324 allows subsequent resource exhaustion or escalation to root.

Why it matters to the business

On unpatched Ubuntu systems an unprivileged user can exhaust disk or inode resources or obtain full administrative control, resulting in service outages, data loss, or complete system takeover; the issue has been public for years with no known active campaigns but still requires verification on legacy deployments.

How an attack unfolds

An attacker on a local Ubuntu host executes a setuid binary that crashes, triggering Apport; by supplying a crafted core dump or environment the attacker causes Apport to write chosen files as root, which can be leveraged to overwrite critical configuration or binaries for denial of service or privilege escalation.

How to fix it

Upgrade the apport package to a version containing the complete fix for both CVE-2015-1324 and CVE-2017-14177; if a fixed package is unavailable, disable core-dump handling for setuid binaries or remove the apport package entirely until an update can be applied.

How to confirm the fix worked

Confirm the installed apport package version is newer than 2.20.7 and that the setuid core-dump code path has been removed or properly restricted; test by attempting to crash a setuid binary and verifying that no unexpected root-owned files are created in /var/crash or other writable locations.

Typical attack path

1. Obtain local shell access on an affected Ubuntu system
2. Invoke a setuid binary in a way that forces a crash and core-dump generation
3. Manipulate Apport's handling of the core dump to create or overwrite files owned by root
4. Use the newly created root-owned artifacts to exhaust resources or replace system binaries
5. Escalate to root or induce denial of service

How to detect it

Review /var/log/apport.log and /var/crash for entries showing core-dump processing of setuid binaries; inspect file-creation timestamps and ownership of files written during apport execution; correlate with auth.log for unexpected root-owned file modifications around the same time.

What your security team should do

• Inventory all Ubuntu systems and identify those still running apport <= 2.20.7
• Apply the latest apport updates from Canonical repositories immediately
• Disable apport for setuid processes via configuration if patching is delayed
• Monitor package update channels for any remaining legacy releases