CVE-2018-6552

What it actually does

The is_same_ns() check and subsequent forwarding logic in apport incorrectly substitute a container PID for the host_pid when the global /proc entry is absent, allowing a local process to cause apport to write or truncate arbitrary files as root in the host namespace.

Why it matters to the business

Attackers on a shared system or inside a container can exhaust disk or inode resources, obtain root privileges on the host, or break out of container isolation, leading to full system compromise or widespread service disruption.

How an attack unfolds

An attacker running inside a PID namespace triggers a crash that apport is configured to handle, then abuses the PID substitution flaw so that apport performs privileged file operations on the host rather than inside the container, resulting in root-owned files or resource exhaustion.

How to fix it

Upgrade apport to a version containing the corrected namespace handling logic; on Ubuntu systems apply the vendor-supplied package updates that address the PID substitution error.

How to confirm the fix worked

Confirm the installed apport package version is newer than the affected ranges listed in the advisory and test that crashes originating from a PID namespace are correctly forwarded using the host PID.

Typical attack path

1. Obtain a shell or process inside a container or unprivileged PID namespace
2. Force a crash of a process whose core dump is handled by apport
3. Trigger the flawed namespace check that fails to replace sys.argv[1] with host_pid
4. Cause apport to create, truncate, or write files as root on the host filesystem
5. Leverage the resulting files for DoS, privilege escalation, or container escape

How to detect it

Examine apport logs and /var/log/syslog for entries showing crashes processed with mismatched PID namespaces; look for sudden creation of root-owned files in crash directories or unusual resource exhaustion patterns on hosts running containers.

What your security team should do

• Prioritize patching apport on all Ubuntu systems that still run the vulnerable versions
• Review container runtime configurations to ensure crash handlers cannot write to host paths
• Monitor for unexpected root-owned files appearing in /var/crash or other apport directories