CVE-2020-11937

What it actually does

Local memory leak in parse_report() triggered by a crafted file leads to unbounded resource consumption and eventual denial of service.

Why it matters to the business

Local users can render the affected system unresponsive, disrupting crash reporting and any dependent monitoring or support workflows until the process is killed or the system is restarted.

How an attack unfolds

An attacker with local access prepares a specially crafted file and invokes the whoopsie parsing routine; repeated or sustained submission exhausts memory, causing the service to become unavailable.

How to fix it

Upgrade whoopsie to one of the fixed releases 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 or 0.2.69ubuntu0.1 (or later) via the distribution package manager and restart the service.

How to confirm the fix worked

Verify the installed whoopsie package version matches or exceeds a listed fixed release; confirm the memory-leak path is no longer reachable by reviewing the updated source or running a regression test with the crafted file.

Typical attack path

1. Obtain local shell or user context on an affected Ubuntu system
2. Craft or obtain a malicious report file that triggers the leak in parse_report()
3. Repeatedly feed the file to whoopsie to exhaust available memory
4. Observe service degradation or crash, confirming denial of service

How to detect it

Review system and whoopsie logs for repeated invocations of parse_report on user-supplied files; correlate with memory-usage spikes or OOM killer events targeting the whoopsie process.

What your security team should do

• Apply the vendor-supplied package update immediately on all affected Ubuntu systems
• Restrict local user access where feasible until patches are deployed
• Monitor for unusual memory growth in whoopsie processes as a temporary detection measure