Cloudanix VulnDB

CVE-2019-7307

High · 7.0

CVSS

7.0

EPSS

0.3%

Published

Aug 29, 2019

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Ubuntu's crash-reporting tool lets any local user read private files they should not have access to by tricking the reporter into copying their contents.

Exploit Available Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Data Exposure
Component
Application
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

TOCTTOU race condition in Apport allows a local attacker to swap ~/.apport-ignore.xml with a symlink to an arbitrary file; Apport then reads and embeds the target file's contents into a crash report that the attacker can later retrieve.

Why it matters to the business

Local users on affected Ubuntu systems can obtain contents of any readable file, including credentials, private keys, or configuration data, enabling lateral movement or data theft without elevated privileges.

How an attack unfolds

An attacker replaces the ignore file with a symlink to a chosen target, forces a process crash so Apport processes the report, then retrieves the resulting crash file (via Launchpad upload or local access) to obtain the target's contents.

How to fix it

Upgrade Apport to one of the fixed releases: 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, or 2.20.11-0ubuntu5. Remove or secure any existing symlinks at ~/.apport-ignore.xml and disable automatic crash reporting until patched.

How to confirm the fix worked

Confirm the installed Apport package version matches or exceeds a fixed release; attempt to reproduce the symlink race in a test environment and verify that the generated report no longer follows symlinks to arbitrary files.

Typical attack path

  1. Create or replace ~/.apport-ignore.xml with a symlink pointing to the desired target file
  2. Trigger a crash in any process that invokes Apport
  3. Wait for or force Apport to generate the crash report containing the linked file's data
  4. Read the crash report directly or via upload to obtain the exfiltrated contents

How to detect it

Search system and user home directories for symlinks named .apport-ignore.xml; inspect recent Apport-generated crash reports for unexpected file contents; review logs for Apport invocations followed by rapid file-access anomalies.

  • ~/.apport-ignore.xml
  • /var/crash/*.crash
  • apport
  • symlink to arbitrary file in home directory

What your security team should do

  • Apply the listed Apport updates on all Ubuntu systems immediately
  • Audit home directories for unexpected symlinks named .apport-ignore.xml
  • Temporarily disable Apport crash reporting where feasible until patches are deployed
  • Monitor for unusual crash-report uploads or local report files containing sensitive data

The record

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS apport 0 2.14.1-0ubuntu3.29+esm1
Ubuntu:16.04:LTS apport 0 2.20.1-0ubuntu2.19
Ubuntu:18.04:LTS apport 0 2.20.9-0ubuntu7.7
Ubuntu:Pro:14.04:LTS apport 0 2.14.1-0ubuntu3.29+esm1

Related vulnerabilities